URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt targets adversaries leveraging the Mozi backdoor to establish persistent access and exfiltrate sensitive data through malicious URLs identified by URLhaus. Proactively searching for these indicators in Azure Sentinel is critical to detect early-stage espionage campaigns before they compromise internal assets or expand their foothold within the network.

IOC Summary

Threat: Mozi Total URLs: 6 Active URLs: 6

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["112.237.10.53", "123.12.234.194", "110.37.127.45", "61.52.172.124", "182.113.45.51"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["112.237.10.53", "123.12.234.194", "110.37.127.45", "61.52.172.124", "182.113.45.51"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, tailored for an enterprise environment:

• Software Supply Chain Updates via Centralized Patch Management

  • Scenario: The organization uses a centralized patch management solution (e.g., Ivanti Neurons, Microsoft SCCM/Intune, or Tenable Core) to distribute updates. During the monthly maintenance window, these tools download update manifests and installer packages from vendor repositories that host Mozi-related signatures or share similar URL structures with known benign distribution points. The traffic originates from a high-volume server account (e.g., svc-patch-manager) rather than an interactive user session.
  • Suggested Filter/Exclusion: Create an exclusion rule based on the Source Host (specifically patch management servers) and User Agent strings containing “SCCM” or “Ivanti”. Additionally, whitelist specific sub-domains of known software vendors that frequently trigger this signature but have a low threat history.

• Automated Security Scanning by Endpoint Protection Agents

  • Scenario: The enterprise deploys an EDR/XDR solution (e.g., CrowdStrike Falcon, SentinelOne, or Carbon Black) configured to perform daily “threat intelligence feed synchronization.” These agents proactively query URL reputation services and download definition files from external feeds. If the Mozi detection logic flags a specific endpoint within the threat intelligence vendor’s domain that is part of this routine handshake, it will generate alerts for every agent across the fleet simultaneously.
  • Suggested Filter/Exclusion: Exclude traffic originating from the Service Account used by the EDR agents (e.g., svc-edr-agent) and filter on specific Destination Ports commonly used for feed updates (e.g., 80, 443) combined with a high-frequency threshold