URLhaus: Mozi Malicious URLs

Hunt Hypothesis

The hunt hypothesis detects adversaries using Mozi malware by accessing known malicious URLs from URLhaus, which are associated with command and control infrastructure. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential compromises early in the attack lifecycle.

IOC Summary

Threat: Mozi Total URLs: 10 Active URLs: 9

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["112.248.107.27", "119.186.206.114", "42.231.72.81", "110.36.30.112", "115.59.39.40", "219.156.19.188", "123.12.232.53"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["112.248.107.27", "119.186.206.114", "42.231.72.81", "110.36.30.112", "115.59.39.40", "219.156.19.188", "123.12.232.53"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: Legitimate URLhaus URL used for threat intelligence sharing
  Description: A security team member manually inputs a URL from URLhaus into a threat intelligence platform for analysis.
  Filter/Exclusion: Exclude URLs that are manually entered into threat intel platforms by users with “Threat Intelligence Analyst” role or those that match known URLhaus hashes.

• Scenario: Scheduled job for malware sample submission to URLhaus
  Description: A scheduled job automatically submits malware samples to URLhaus for analysis, which includes generating and accessing URLs.
  Filter/Exclusion: Exclude URLs originating from scheduled jobs with names like “submit_to_urlhaus.sh” or “malware_submission_job” running under a service account.

• Scenario: Admin task to update URLhaus database
  Description: An admin runs a script to fetch and update the URLhaus database, which includes downloading and accessing URLs.
  Filter/Exclusion: Exclude URLs accessed by processes running under the “admin” or “urlhaus_update” service account, or those matching known URLhaus API endpoints.

• Scenario: User accessing URLhaus for research purposes
  Description: A security researcher accesses URLhaus through a browser or API to study known malicious URLs for educational or investigative purposes.
  Filter/Exclusion: Exclude URLs accessed by users with “Researcher” or “Analyst” roles, or those that match known URLhaus research endpoints.

• Scenario: Log management tool accessing URLhaus for correlation
  Description: A log management tool like Splunk or ELK accesses URLhaus to correlate logs with known malicious URLs.
  Filter/Exclusion: Exclude URLs accessed by tools like splunk or logstash that are configured to query URLhaus for correlation purposes.