URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where compromised hosts initiate outbound connections to known Mozi malware command-and-control infrastructure via specific malicious URLs identified by URLhaus. Proactively hunting for these indicators in Azure Sentinel is critical because Mozi’s modular architecture allows it to pivot quickly across networks, making early detection of its initial communication essential to prevent lateral movement and data exfiltration before full infection occurs.

IOC Summary

Threat: Mozi Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["112.237.210.145", "219.157.233.184"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["112.237.210.145", "219.157.233.184"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Automated Software Supply Chain Updates via Package Managers

  • Scenario: Enterprise endpoints running automated update agents (e.g., WSUS, Chocolatey, or Ansible) frequently pull metadata and binary packages from vendor repositories. If a legitimate vendor (such as a major software publisher) recently hosted an update on a domain that was temporarily flagged by URLhaus for Mozi activity, the agent’s background traffic will trigger the rule during scheduled maintenance windows.
  • Suggested Filter: Exclude traffic originating from known internal management servers or specific service accounts (e.g., svc-chocolatey, WSUS-Update-Agent) accessing whitelisted vendor domains (e.g., *.microsoft.com, choco.org).

• IT Administration and Patch Management Tasks

  • Scenario: System administrators performing routine patch management or configuration tasks using tools like SCCM (System Center Configuration Manager) or Jamf Pro. During a mass deployment, the admin console may query external documentation portals or download patches from URLs that share infrastructure with known Mozi campaigns. For instance, an admin clicking a link in a vendor’s release notes email to verify patch details could trigger the detection if the URL is flagged but safe for internal consumption.
  • Suggested Filter: Create an exclusion based on the User-Agent string containing specific administration tool signatures (e.g., SCCM-Client, Jamf-Pro) or exclude traffic from the “IT Operations” organizational unit (OU) accessing URLs with a high reputation score despite the Mozi tag.

• Scheduled Backup and Cloud Sync Jobs

  • Scenario: Scheduled backup jobs utilizing cloud storage solutions like Veeam, Rubrik, or **