URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity where endpoints access known Mozi malware distribution channels by connecting to specific malicious URLs identified in the URLhaus threat intelligence feed. A SOC team should proactively hunt for this behavior in Azure Sentinel because Mozi is a prevalent mobile banking trojan that can compromise financial data, and early identification of these connections allows for immediate containment before lateral movement or credential theft occurs.

IOC Summary

Threat: Mozi Total URLs: 10 Active URLs: 9

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["110.36.86.148", "42.224.85.143", "125.44.34.3", "110.38.214.61", "182.127.3.76", "182.116.34.54"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["110.36.86.148", "42.224.85.143", "125.44.34.3", "110.38.214.61", "182.127.3.76", "182.116.34.54"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, along with targeted filters and exclusions:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Microsoft Defender Vulnerability Management) periodically probe external threat intelligence feeds to validate their own signature databases. These tools often query the mozi feed directly, generating legitimate HTTP requests that match the rule’s logic for malicious URLs.
  • Filter/Exclusion: Create an exclusion based on the Source Host or Process Name. Exclude traffic originating from known scanner service accounts (e.g., Tenable.Scanner.Service) or specific IP ranges dedicated to the security operations center (SOC) infrastructure.

• Scenario: Scheduled Threat Intelligence Ingestion Jobs

  • Context: Enterprise Endpoint Detection and Response (EDR) platforms like CrowdStrike Falcon or SentinelOne run scheduled background jobs every 4-6 hours to ingest external threat feeds. These jobs download the Mozi JSON feed to update local blocklists, triggering the detection logic as a “malicious URL visit” even though it is an administrative data pull.
  • Filter/Exclusion: Implement a time-based filter or process exclusion for specific scheduled tasks (e.g., C:\Program Files\CrowdStrike\csfalcon.exe running during maintenance windows between 02:00 and 04:00). Alternatively, exclude URLs containing the specific feed endpoint path (e.g., .../api/v1/mozi/feed.json).

• Scenario: Admin Manual Threat Research

  • Context: Security analysts or IT administrators manually investigate potential threats by visiting the URLhaus Mozi dashboard or downloading sample reports via their corporate browsers (Microsoft Edge, **Google