URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where attackers leverage Mozi-tagged malicious URLs to deliver payloads or conduct phishing campaigns within the Azure environment. Proactively hunting for these specific indicators in Azure Sentinel is critical because Mozi threats often represent sophisticated, targeted attacks that require immediate containment before they can establish persistence or exfiltrate sensitive data.

IOC Summary

Threat: Mozi Total URLs: 5 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["115.55.177.183", "182.127.4.27", "222.141.122.76", "115.61.51.91", "123.5.158.194"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["115.55.177.183", "182.127.4.27", "222.141.122.76", "115.61.51.91", "123.5.158.194"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Protection Policy Updates via Microsoft Defender for Endpoint

  • Scenario: The centralized management console triggers a scheduled daily update job where endpoint agents (e.g., on Windows 10/11 workstations) pull definition updates from the update.microsoft.com or specific CDN endpoints. If Mozi has flagged a newly rotated sub-domain of Microsoft’s content delivery network as suspicious due to shared IP reputation, legitimate agent traffic will trigger the rule across hundreds of machines simultaneously.
  • Suggested Filter: Exclude traffic originating from the specific Microsoft Defender for Endpoint service account (e.g., NT AUTHORITY\SYSTEM or a dedicated GPO update user) accessing URLs containing *.update.microsoft.com or *.go.microsoft.com.

• Automated Software Supply Chain Scanning by JFrog Artifactory

  • Scenario: A nightly CI/CD pipeline job utilizes JFrog Artifactory to synchronize internal repositories with external Maven and NPM registries. The build server connects to a third-party artifact mirror that Mozi has recently tagged as “suspicious” due to a transient certificate issue or high-volume scanning activity, causing the hunt package to flag these routine dependency fetches as malicious.
  • Suggested Filter: Create an exclusion for traffic generated by the Jenkins or GitLab Runner service accounts (e.g., svc-jenkins-build) accessing known artifact repository domains such as *.maven.org, *.npmjs.com, or specific internal mirror URLs defined in the supply chain policy.

• Enterprise SSO and Identity Federation Health Checks by Okta/Azure AD

  • Scenario: The identity provider (Okta or **Microsoft