URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where attackers leverage compromised or newly registered domains identified by URLhaus to deliver Mozi malware payloads through malicious web traffic. Proactively hunting for these specific indicators in Azure Sentinel is critical because early detection of Mozi-associated URLs can prevent the establishment of persistent command-and-control channels before lateral movement occurs within the enterprise network.

IOC Summary

Threat: Mozi Total URLs: 7 Active URLs: 7

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["112.248.191.34", "42.226.208.136", "46.236.65.155", "110.37.64.27", "182.113.47.114"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["112.248.191.34", "42.226.208.136", "46.236.65.155", "110.37.64.27", "182.113.47.114"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Management Patching Cycles

  • Scenario: During nightly maintenance windows, the IT team uses Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ivanti Neurons to push security updates. These agents frequently query Mozi-tagged domains to verify patch signatures and download update manifests before distributing them to endpoints. Because these queries originate from trusted management servers rather than user workstations, they trigger the rule despite being benign.
  • Suggested Filter: Exclude traffic originating from specific Management Server IP ranges (e.g., 10.50.20.0/24) or filter by User Agent strings containing “SCCMAgent” or “IvantiUpdateService”.

• Automated Threat Intelligence Ingestion

  • Scenario: The organization’s Security Information and Event Management (SIEM) system, such as Splunk Enterprise Security or IBM QRadar, runs a scheduled Python script using the requests library to pull daily threat feeds. This script actively probes known Mozi URLs to validate their current reputation status and update internal blocklists. The high volume of HTTP GET requests from the SIEM collector hits the detection threshold, generating alerts for routine health checks.
  • Suggested Filter: Create an exclusion rule based on the Source Hostname (e.g., siem-collector-01.corp.local) or exclude traffic where the HTTP Method is GET and the User-Agent contains “Python-urllib” during scheduled job hours (e.g., 02:00–04:00 UTC).

• Software Supply Chain Verification

  • Scenario: The DevOps team