URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt hypothesis posits that adversaries are leveraging Mozi-malicious URLs to deliver targeted payloads or conduct phishing campaigns against Azure-connected endpoints. Proactively hunting for these specific indicators in Azure Sentinel is critical because early detection of Mozi activity can prevent lateral movement and data exfiltration before the threat escalates into a full-blown incident.

IOC Summary

Threat: Mozi Total URLs: 4 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["42.231.66.147", "36.36.250.212", "125.41.3.43", "112.248.61.25"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.231.66.147", "36.36.250.212", "125.41.3.43", "112.248.61.25"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Management Console Scans

  • Scenario: The centralized management console (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) performs scheduled integrity checks on agent configurations. These agents frequently query the mozi subdomain of the vendor’s update servers to fetch policy definitions, which may contain legacy URLs flagged by URLhaus as “Mozi” due to shared infrastructure with known threat clusters.
  • Filter/Exclusion: Create an exclusion rule for traffic originating from internal management server IP ranges (e.g., 10.x.x.x) destined specifically for the vendor’s update domain (e.g., *.crowdstrike.com or *.sentinelone.net). Additionally, filter by process name to exclude the specific agent service executable (e.g., csagent.exe or S1Service.exe).

• Automated Software Supply Chain Updates

  • Scenario: Scheduled deployment jobs using configuration management tools like Ansible, Chef, or Puppet execute scripts that pull dependencies from internal artifact repositories. These repositories often mirror external package feeds (such as those hosted on Maven Central or NuGet) which utilize the Mozi CDN infrastructure for content delivery, triggering the rule during routine patch cycles.
  • Filter/Exclusion: Exclude traffic generated by known build and deployment service accounts (e.g., svc-ansible, svc-puppet) accessing internal artifact repository URLs (e.g., artifacts.internal.corp). Implement a whitelist for specific URL paths containing /maven/ or /nuget/ when the source is an internal CI/CD server.

• **Enterprise Browser Extension S