URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where threat actors leverage specific Mozi-malicious URLs to deliver payloads or conduct phishing campaigns against Azure-connected endpoints. Proactively hunting these indicators in Azure Sentinel is critical because early detection of these known malicious domains can prevent lateral movement and data exfiltration before the broader Mozi campaign impacts the organization’s cloud infrastructure.

IOC Summary

Threat: Mozi Total URLs: 9 Active URLs: 9

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["123.14.216.150", "42.227.185.241", "219.157.132.212", "124.29.223.148", "123.14.33.167", "123.14.250.205"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["123.14.216.150", "42.227.185.241", "219.157.132.212", "124.29.223.148", "123.14.33.167", "123.14.250.205"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, tailored for an enterprise environment:

• Scheduled Software Updates via Patch Management Tools

  • Scenario: Enterprise patch management systems (e.g., Microsoft SCCM, Ivanti Endpoint Manager, or Jamf) frequently pull update manifests and installer packages from vendor repositories. If a legitimate software vendor hosts their download servers on infrastructure recently flagged by URLhaus as “Mozi” (often due to shared hosting environments or CDN misconfigurations), the scheduled nightly update jobs will trigger alerts when downloading patches for critical applications like Adobe Creative Cloud or Java Runtime Environments.
  • Suggested Filter: Create an exclusion based on the Process Name of the patch agent (e.g., ccmexec.exe, IvantiAgentService.exe) combined with a whitelist of known vendor domains (e.g., *.adobe.com, *.oracle.com) that are currently flagged by URLhaus but verified as safe in your internal threat intelligence feed.

• Admin-Initiated Security Tool Configuration Syncs

  • Scenario: During routine maintenance windows, security administrators may manually trigger configuration synchronization or policy updates for endpoint protection suites (e.g., CrowdStrike Falcon, SentinelOne, or Trend Micro Apex One). These tools often fetch definition files and behavioral models from cloud endpoints. If the Mozi signature matches a specific CDN node used by these vendors to distribute large binary files, legitimate admin-initiated sync tasks will generate high-volume alerts that mimic malicious activity.
  • Suggested Filter: Implement a filter excluding traffic originating from Service Accounts (e.g., svc-security-updates, admin-sync) and targeting specific User-Agent strings associated with the security vendor’s internal update clients, provided the destination IP belongs to the vendor’s known ASN range.