This hunt detects adversary behavior where attackers leverage Mozi-tagged malicious URLs to deliver payloads that may compromise endpoints through web-based threats. A SOC team should proactively hunt for these indicators in Azure Sentinel because Mozi’s reputation as a sophisticated threat actor necessitates early identification of its evolving URL infrastructure to prevent potential lateral movement and data exfiltration.
Threat: Mozi Total URLs: 42 Active URLs: 42
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://123.14.217.252:58040/bin.sh | online | malware_download | 2026-08-25 |
hxxp://42.231.182.127:42828/i | online | malware_download | 2026-08-25 |
hxxp://182.114.48.35:56580/bin.sh | online | malware_download | 2026-08-25 |
hxxp://182.127.42.125:50556/i | online | malware_download | 2026-08-25 |
hxxp://123.9.80.236:60059/i | online | malware_download | 2026-08-25 |
hxxp://27.206.151.130:55378/bin.sh | online | malware_download | 2026-08-25 |
hxxp://42.224.122.200:55867/bin.sh | online | malware_download | 2026-08-25 |
hxxp://182.123.210.95:48050/i | online | malware_download | 2026-08-25 |
hxxp://222.141.36.152:36990/i | online | malware_download | 2026-08-25 |
hxxp://115.50.224.166:50810/i | online | malware_download | 2026-08-25 |
hxxp://115.62.159.162:33981/i | online | malware_download | 2026-08-25 |
hxxp://123.5.170.227:57371/i | online | malware_download | 2026-08-25 |
hxxp://42.224.122.200:55867/i | online | malware_download | 2026-08-25 |
hxxp://115.57.229.170:49217/i | online | malware_download | 2026-08-25 |
hxxp://61.52.215.65:33601/bin.sh | online | malware_download | 2026-08-25 |
hxxp://221.15.193.147:56368/bin.sh | online | malware_download | 2026-08-25 |
hxxp://125.44.62.105:40766/bin.sh | online | malware_download | 2026-08-25 |
hxxp://219.157.182.229:47636/bin.sh | online | malware_download | 2026-08-25 |
hxxp://125.43.45.65:55210/i | online | malware_download | 2026-08-25 |
hxxp://222.140.185.20:49795/bin.sh | online | malware_download | 2026-08-25 |
hxxp://123.4.198.85:59307/i | online | malware_download | 2026-08-25 |
hxxp://182.127.112.52:54660/i | online | malware_download | 2026-08-25 |
hxxp://103.203.210.102:53995/i | online | malware_download | 2026-08-25 |
hxxp://61.52.78.61:46235/bin.sh | online | malware_download | 2026-08-25 |
hxxp://115.57.123.19:54898/i | online | malware_download | 2026-08-25 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["182.114.48.35", "125.44.62.105", "61.52.215.65", "125.43.45.65", "221.15.193.147", "182.127.42.125", "123.9.80.236", "115.62.159.162", "39.79.144.82", "123.14.217.252", "182.127.112.52", "222.140.185.20", "123.11.96.137", "125.42.76.153", "115.50.224.166", "103.203.210.102", "42.231.182.127", "27.206.151.130", "123.5.170.227", "42.224.122.200", "81.227.54.149", "123.4.198.85", "115.57.229.170", "61.52.78.61", "219.157.182.229", "182.123.210.95", "115.57.123.19", "222.141.36.152", "87.68.238.101"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.114.48.35", "125.44.62.105", "61.52.215.65", "125.43.45.65", "221.15.193.147", "182.127.42.125", "123.9.80.236", "115.62.159.162", "39.79.144.82", "123.14.217.252", "182.127.112.52", "222.140.185.20", "123.11.96.137", "125.42.76.153", "115.50.224.166", "103.203.210.102", "42.231.182.127", "27.206.151.130", "123.5.170.227", "42.224.122.200", "81.227.54.149", "123.4.198.85", "115.57.229.170", "61.52.78.61", "219.157.182.229", "182.123.210.95", "115.57.123.19", "222.141.36.152", "87.68.238.101"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:
Scenario: Automated Software Update Scanners
C:\Program Files\CrowdStrike\csagent.exe or C:\Windows\System32\DefenderSvc) when accessing known vendor update domains associated with Mozi.Scenario: Scheduled Backup and Archiving Jobs
VeeamService.exe or RubrikAgent.exe) to suppress alerts during maintenance windows.Scenario: Internal Knowledge Base and Documentation Portals