URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior where endpoints access known Mozi malware distribution channels via specific malicious URLs identified by URLhaus. The SOC team should proactively investigate these connections in Azure Sentinel to identify early-stage infections and prevent lateral movement before the ransomware payload executes.

IOC Summary

Threat: Mozi Total URLs: 5 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["112.248.255.206", "125.47.238.167", "103.31.103.204", "125.41.7.156"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["112.248.255.206", "125.47.238.167", "103.31.103.204", "125.41.7.156"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule in an enterprise environment, along with recommended filters or exclusions:

• Security Team Phishing Simulation Campaigns

  • Scenario: The IT Security team utilizes platforms like KnowBe4 or Proofpoint to run internal phishing simulations. These tools often dynamically generate or embed test URLs that mimic the structure of known malicious domains (including Mozi variants) to train users, inadvertently triggering the rule when analysts click these links during testing.
  • Filter/Exclusion: Create an exclusion for traffic originating from the specific IP ranges assigned to the security simulation platform or filter by User-Agent strings containing KnowBe4-Sim or Proofpoint-Phish.

• Automated Vulnerability Scanning and Patch Management

  • Scenario: Scheduled jobs running on Qualys, Tenable Nessus, or Microsoft SCCM/Intune perform daily vulnerability assessments. These scanners frequently query external threat intelligence feeds and vendor update repositories that may host Mozi-tagged URLs as part of their baseline signature updates, generating alerts during the early morning maintenance window (e.g., 02:00 – 04:00 UTC).
  • Filter/Exclusion: Exclude traffic from known scanner service accounts (e.g., svc-qualys-scanner, intune-agent) and apply a time-based filter to suppress alerts for these sources during the defined maintenance window.

• IT Admin Access to Cloud Management Portals

  • Scenario: System administrators accessing third-party SaaS management consoles, such as AWS Console, Azure Portal, or specific vendor dashboards (e.g., CrowdStrike Falcon), often navigate through deep-link URLs that redirect through Mozi-identified domains for authentication tokens or asset inventory checks. This is