URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where attackers leverage known Mozi malware distribution channels to deliver malicious payloads through specific web endpoints. Proactively hunting for these URLs in Azure Sentinel is critical because Mozi’s association with supply chain compromises and credential theft requires immediate identification of early-stage infection vectors before they escalate into broader lateral movements.

IOC Summary

Threat: Mozi Total URLs: 4 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["182.121.105.160", "182.119.196.129", "125.41.3.43"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.121.105.160", "182.119.196.129", "125.41.3.43"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Software Update Mechanisms via Vendor Portals

  • Scenario: The organization uses Microsoft Endpoint Configuration Manager (MECM/SCCM) or Intune to push updates for critical applications like Adobe Acrobat Reader or Java. These update agents frequently fetch manifests and binaries from vendor-specific CDNs that may host dynamic URLs flagged by URLhaus as “Mozi” due to shared IP infrastructure with known adware distributors, even though the specific endpoints are legitimate update servers.
  • Filter/Exclusion: Create a whitelist rule excluding traffic originating from internal management servers (e.g., SCCM-01, Intune-Agent) accessing domains ending in .update.microsoft.com or specific vendor CDNs (e.g., adobe.io, java.com).

• Scheduled Security Scans by Endpoint Protection

  • Scenario: A nightly scheduled job runs on the CrowdStrike Falcon or SentinelOne agents to fetch threat intelligence feeds and definition updates. The agent connects to a URLhaus-verified feed server that dynamically generates short-lived URLs for downloading signature packs. These URLs are sometimes tagged as “Mozi” because they utilize the same underlying infrastructure as known adware, triggering the rule despite being part of a trusted security maintenance window.
  • Filter/Exclusion: Exclude events where the Process Name is the specific EDR agent executable (e.g., csfalcon.exe, sentinel-agent.exe) and the User Account is the system service account (e.g., NT AUTHORITY\SYSTEM or LocalService).

• Automated Reporting and Dashboard Refreshes

  • Scenario: The IT Operations team utilizes Splunk or