URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity where the Mozi backdoor establishes persistence by executing remote commands and exfiltrating sensitive data through malicious URLs. A proactive hunt in Azure Sentinel is critical to immediately isolate compromised endpoints and prevent lateral movement before attackers can leverage this backdoor for long-term access or data theft.

IOC Summary

Threat: Mozi Total URLs: 10 Active URLs: 10

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["27.215.124.43", "182.116.113.206", "39.90.150.62", "110.38.223.172", "182.117.30.230", "182.121.231.159"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["27.215.124.43", "182.116.113.206", "39.90.150.62", "110.38.223.172", "182.117.30.230", "182.121.231.159"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, tailored for a legitimate enterprise environment:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability management tools (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) perform daily external web crawls. These scanners often probe internal and public-facing URLs to check for known malware signatures, occasionally triggering the Mozi rule when they visit a legitimate endpoint that hosts similar URL patterns.
  • Filter/Exclusion: Create an exclusion based on the Source IP of the scanner appliance or the Process Name (e.g., nessus.exe, qualyspcd.exe). Exclude traffic where the process is running under the system account (SYSTEM) and the destination URL does not match high-risk Mozi indicators.

• Scenario: Cloud Backup and Synchronization Agents

  • Context: Enterprise file synchronization tools like Microsoft OneDrive for Business, Dropbox Business, or Box Sync frequently connect to cloud storage endpoints that may share domain structures with known Mozi command-and-control (C2) servers. During large file uploads or delta syncs, these agents generate HTTPS traffic that mimics the backdoor behavior of Mozi.
  • Filter/Exclusion: Add a filter for specific Process Names (OneDrive.exe, Dropbox.exe) and exclude URLs containing known cloud storage domains (e.g., *.sharepoint.com, *.dropboxapi.com). Additionally, verify that the connection is initiated by a scheduled task rather than user interaction.

• Scenario: Scheduled Patch Management Deployments

  • Context: Automated patching solutions such as Microsoft Configuration Manager (SCCM/MECM) or Ivanti Neurons download update manifests and installation packages