URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where threat actors leverage compromised or newly registered domains associated with the Mozi malware to deliver malicious payloads via web traffic. Proactively hunting these specific URL patterns in Azure Sentinel is critical because it enables the SOC team to identify early-stage infection vectors and block lateral movement before the malware establishes persistence across the enterprise network.

IOC Summary

Threat: Mozi Total URLs: 7 Active URLs: 7

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["222.138.126.62", "110.37.13.213", "60.214.58.128", "112.246.11.204", "219.157.179.136", "115.57.255.73"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["222.138.126.62", "110.37.13.213", "60.214.58.128", "112.246.11.204", "219.157.179.136", "115.57.255.73"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Management Console Scans

  • Scenario: The centralized management server (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) initiates a scheduled daily health check. During this scan, the agent queries internal update repositories that host signed binaries and configuration scripts which may contain URL patterns similar to Mozi’s known malicious signatures.
  • Filter/Exclusion: Create an exclusion rule based on the Process Name (e.g., falcon.sys, SensAgent.exe) or the User Account (e.g., DOMAIN\svc-endpoint-mgmt). Additionally, exclude traffic originating from the specific IP range of the internal management server.

• Automated Software Patching and Inventory Jobs

  • Scenario: A scheduled task running under a service account (e.g., using Ansible, SCCM/MECM, or PDQ Deploy) performs software inventory updates. The job downloads metadata manifests from third-party vendor portals that host legitimate software installers, which may inadvertently match the Mozi URL hash signatures due to shared library dependencies or common web frameworks.
  • Filter/Exclusion: Exclude alerts where the Parent Process is identified as a known automation tool (e.g., ansible-runner.exe, ccmexec.exe) and the destination domain belongs to approved vendor whitelists (e.g., *.microsoft.com, *.oracle.com).

• Browser-Based Security Awareness Training and Phishing Simulations

  • Scenario: The organization’s security team deploys a phishing simulation campaign using tools like KnowBe4, Proofpoint, or Cofense. These platforms dynamically