URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This rule detects adversary behavior where threat actors leverage Mozi-tagged malicious URLs to deliver payloads that compromise user endpoints through web browsing activities. A SOC team should proactively hunt for these indicators in Azure Sentinel to identify early-stage infections and prevent lateral movement before the malware establishes persistence within the network.

IOC Summary

Threat: Mozi Total URLs: 10 Active URLs: 9

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["42.226.68.162", "110.36.29.195", "61.53.153.17", "27.220.11.19", "115.48.151.195", "42.226.71.247"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.226.68.162", "110.36.29.195", "61.53.153.17", "27.220.11.19", "115.48.151.195", "42.226.71.247"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Automated vulnerability scanners performing deep web crawls.

  • Context: Tools like Tenable Nessus, Qualys, or Burp Suite Enterprise often probe thousands of external endpoints daily. When these tools scan legacy partner sites or newly acquired domains, they may encounter URLs that the Mozi engine flags as suspicious due to non-standard redirects or certificate chains, even though the traffic is purely diagnostic.
  • Suggested Filter/Exclusion: Create a rule exclusion based on the User-Agent string (e.g., Tenable.Nessus, QualysCloudAgent) and restrict the scope to specific Service Accounts used by these scanners. Alternatively, exclude traffic originating from the dedicated DMZ subnet where scanning appliances reside.

• Scenario: Scheduled backup jobs accessing cloud storage or archive repositories.

  • Context: Enterprise backup solutions such as Veeam Backup & Replication, Rubrik, or Commvault frequently generate time-bound API calls to retrieve manifests from external S3 buckets, Azure Blob Storage, or legacy FTP archives. These URLs often contain dynamic query parameters and long paths that Mozi may misinterpret as obfuscation techniques typical of the Mozi malware family.
  • Suggested Filter/Exclusion: Implement a time-based exclusion for these specific backup service accounts during their scheduled maintenance windows (e.g., 02:00–04:00 UTC). Additionally, whitelist known cloud storage domains (e.g., *.amazonaws.com, *.azureedge.net) in the detection logic to bypass Mozi-specific URL checks for these destinations.

• Scenario: Third-party SaaS integration webhooks and API callbacks.