URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt detects adversary activity involving the Mozi malware family by identifying traffic to known malicious URLs that facilitate initial infection and command-and-control communication. SOC teams should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints before the malware establishes persistence or exfiltrates sensitive data.

IOC Summary

Threat: Mozi Total URLs: 9 Active URLs: 8

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["39.87.15.172", "222.142.220.59", "182.121.197.90", "178.66.229.151", "222.137.85.152", "123.11.15.96"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["39.87.15.172", "222.142.220.59", "182.121.197.90", "178.66.229.151", "222.137.85.152", "123.11.15.96"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, along with targeted filters and exclusions:

• Scenario: Automated Patch Management Scans via WSUS or SCCM

  • Context: Enterprise patch management tools like Microsoft System Center Configuration Manager (SCCM) or Windows Server Update Services (WSUS) frequently query external repositories to check for the latest security definitions and software updates. These queries often hit Mozi-tagged URLs that are part of a broader update feed, triggering alerts when the tool performs routine health checks rather than actual malware downloads.
  • Filter/Exclusion: Create an exclusion rule based on the Source Host (e.g., WSUS-Server01, SCCM-CAS) and the specific Process Name (wuauserv.exe or ccmexec.exe). Exclude traffic where the process is running under a trusted service account (e.g., NT SERVICE\WUAUSERV).

• Scenario: Scheduled Endpoint Protection Definition Updates

  • Context: Security agents such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black often run scheduled jobs to download threat intelligence feeds. The Mozi detection logic may flag the specific URLs used by these vendors’ update servers as “malicious” because they are recently added to the URLhaus database but are actually part of a legitimate vendor signature update cycle.
  • Filter/Exclusion: Implement a filter based on the Process Name (e.g., C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe or MsMpEng.exe) and restrict the alert to only trigger if the destination URL does not match known vendor update domains. Alternatively, exclude alerts where the User Context is a system account (e.g., SYSTEM, LOCAL SERVICE).

• **Scenario: Admin-