URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt targets adversaries leveraging Mozi malware to execute malicious downloads or phishing campaigns via a known set of ten suspicious URLs identified by URLhaus. Proactively hunting for these indicators in Azure Sentinel is critical because early detection of Mozi activity enables rapid containment before the threat establishes persistence or exfiltrates sensitive data from cloud workloads.

IOC Summary

Threat: Mozi Total URLs: 10 Active URLs: 10

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["27.206.189.240", "125.40.115.195", "42.238.170.65", "182.113.40.220", "115.55.217.5", "115.57.243.240", "115.48.11.72"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["27.206.189.240", "125.40.115.195", "42.238.170.65", "182.113.40.220", "115.55.217.5", "115.57.243.240", "115.48.11.72"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule in an enterprise environment, along with targeted filtering strategies:

• Endpoint Security Agent Self-Updates and Telemetry

  • Scenario: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) frequently initiate background connections to their own update servers or telemetry endpoints. If the vendor’s infrastructure shares IP ranges or subdomains with known Mozi distribution networks, legitimate health checks and signature downloads may be flagged as malicious traffic by the URLhaus feed.
  • Filter/Exclusion: Create an exclusion rule for specific process names (e.g., C:\Program Files\CrowdStrike\fs.exe, MsMpEng.exe) connecting to known vendor update domains (e.g., *.crowdstrike.com, *.microsoft.com). Additionally, whitelist the specific SHA-256 hashes of these legitimate executables in the detection logic.

• IT Admin Patch Management and Software Deployment

  • Scenario: During scheduled maintenance windows, IT administrators utilize deployment tools like SCCM (System Center Configuration Manager), Ansible, or Puppet to push patches or install new applications. These tools often download installer packages from public repositories or third-party vendor portals that may host Mozi-tagged URLs as part of their content delivery network (CDN). A bulk download triggered by a scheduled job can generate multiple hits against the “10 malicious URLs” threshold simultaneously.
  • Filter/Exclusion: Implement a time-based filter to suppress alerts during defined maintenance windows (e.g., 02:00–04:00 UTC on Tuesdays). Furthermore, exclude traffic originating from specific management server IPs or service accounts (e.g., DOMAIN\svc-patch-deploy) that are known to perform these bulk download operations.

• **Corporate Web