This detection identifies adversary activity involving the Mozi malware family by monitoring network traffic against a curated list of 37 known malicious URLs to capture initial infection vectors or command-and-control communications. Proactive hunting for these indicators in Azure Sentinel is critical because Mozi’s high-severity threat profile necessitates early identification to prevent lateral movement and data exfiltration before the adversary establishes persistence within the environment.
Threat: Mozi Total URLs: 37 Active URLs: 37
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://112.248.252.55:54907/i | online | malware_download | 2026-08-16 |
hxxp://61.53.205.176:60240/bin.sh | online | malware_download | 2026-08-16 |
hxxp://182.121.83.219:37581/i | online | malware_download | 2026-08-16 |
hxxp://222.137.152.55:53457/bin.sh | online | malware_download | 2026-08-16 |
hxxp://182.121.244.13:44914/bin.sh | online | malware_download | 2026-08-16 |
hxxp://59.96.142.124:33142/bin.sh | online | malware_download | 2026-08-16 |
hxxp://222.141.21.106:38226/bin.sh | online | malware_download | 2026-08-16 |
hxxp://182.121.83.219:37581/bin.sh | online | malware_download | 2026-08-16 |
hxxp://219.155.171.135:36711/bin.sh | online | malware_download | 2026-08-16 |
hxxp://219.155.171.135:36711/i | online | malware_download | 2026-08-16 |
hxxp://182.126.84.239:35309/bin.sh | online | malware_download | 2026-08-16 |
hxxp://110.36.80.162:54439/i | online | malware_download | 2026-08-16 |
hxxp://203.2.151.15:42459/bin.sh | online | malware_download | 2026-08-16 |
hxxp://125.41.247.59:53378/bin.sh | online | malware_download | 2026-08-16 |
hxxp://222.137.152.55:53457/i | online | malware_download | 2026-08-16 |
hxxp://123.11.72.175:34884/bin.sh | online | malware_download | 2026-08-16 |
hxxp://123.11.72.175:34884/i | online | malware_download | 2026-08-16 |
hxxp://182.114.192.138:40709/i | online | malware_download | 2026-08-16 |
hxxp://182.126.84.239:35309/i | online | malware_download | 2026-08-16 |
hxxp://124.131.128.79:53693/bin.sh | online | malware_download | 2026-08-16 |
hxxp://115.55.130.218:47315/i | online | malware_download | 2026-08-16 |
hxxp://103.179.240.227:36804/bin.sh | online | malware_download | 2026-08-16 |
hxxp://110.36.86.0:40490/bin.sh | online | malware_download | 2026-08-16 |
hxxp://124.131.128.79:53693/i | online | malware_download | 2026-08-16 |
hxxp://125.41.247.59:53378/i | online | malware_download | 2026-08-16 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["39.73.126.17", "182.121.83.219", "219.155.171.135", "59.96.142.124", "115.55.130.240", "61.53.205.176", "182.114.192.138", "182.126.84.239", "182.121.244.13", "125.41.247.59", "125.41.228.213", "203.2.151.15", "124.131.128.79", "110.36.80.162", "115.55.130.218", "110.36.86.0", "103.179.240.227", "222.141.21.106", "125.42.65.22", "123.11.72.175", "83.219.1.198", "112.248.252.55", "222.137.152.55"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["39.73.126.17", "182.121.83.219", "219.155.171.135", "59.96.142.124", "115.55.130.240", "61.53.205.176", "182.114.192.138", "182.126.84.239", "182.121.244.13", "125.41.247.59", "125.41.228.213", "203.2.151.15", "124.131.128.79", "110.36.80.162", "115.55.130.218", "110.36.86.0", "103.179.240.227", "222.141.21.106", "125.42.65.22", "123.11.72.175", "83.219.1.198", "112.248.252.55", "222.137.152.55"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:
Scenario: Enterprise Antivirus Cloud Intelligence Updates
Source Host being a specific management server or by filtering traffic where the User Agent contains keywords like CrowdStrike, DefenderAV, or SentinelOne. Alternatively, exclude traffic originating from the “Security Operations” security group.Scenario: Scheduled Backup and Migration Jobs
svc-backup-veeam) that initiate these connections.Scenario: Software Deployment and Patch Management