URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving the Mozi malware family by monitoring traffic to a curated set of 46 known malicious URLs that facilitate command-and-control or payload delivery. Proactive hunting for these indicators in Azure Sentinel is critical because Mozi’s sophisticated evasion techniques often bypass standard signature-based defenses, requiring manual validation to prevent lateral movement and data exfiltration within the network.

IOC Summary

Threat: Mozi Total URLs: 46 Active URLs: 46

URL	Status	Threat	Date Added
`hxxp://117.223.143.124:45357/bin.sh`	online	malware_download	2026-08-18
`hxxp://182.116.114.153:35365/i`	online	malware_download	2026-08-18
`hxxp://115.63.207.26:37498/bin.sh`	online	malware_download	2026-08-18
`hxxp://222.140.180.35:55889/i`	online	malware_download	2026-08-18
`hxxp://115.63.207.26:37498/i`	online	malware_download	2026-08-18
`hxxp://115.55.248.137:53264/i`	online	malware_download	2026-08-18
`hxxp://123.11.242.207:40709/i`	online	malware_download	2026-08-18
`hxxp://92.124.120.65:43084/i`	online	malware_download	2026-08-18
`hxxp://61.54.43.35:53946/bin.sh`	online	malware_download	2026-08-18
`hxxp://123.14.245.119:56931/i`	online	malware_download	2026-08-18
`hxxp://182.121.250.74:60904/i`	online	malware_download	2026-08-18
`hxxp://124.131.167.151:34514/bin.sh`	online	malware_download	2026-08-18
`hxxp://61.53.150.168:38582/i`	online	malware_download	2026-08-18
`hxxp://42.235.173.127:59094/i`	online	malware_download	2026-08-18
`hxxp://115.55.55.19:56855/bin.sh`	online	malware_download	2026-08-18
`hxxp://42.234.245.232:58215/i`	online	malware_download	2026-08-18
`hxxp://182.121.250.74:60904/bin.sh`	online	malware_download	2026-08-18
`hxxp://42.239.252.93:34307/bin.sh`	online	malware_download	2026-08-18
`hxxp://222.139.229.134:40628/i`	online	malware_download	2026-08-18
`hxxp://182.121.153.131:40429/i`	online	malware_download	2026-08-18
`hxxp://42.234.245.232:58215/bin.sh`	online	malware_download	2026-08-18
`hxxp://42.239.252.93:34307/i`	online	malware_download	2026-08-18
`hxxp://123.14.182.147:58870/i`	online	malware_download	2026-08-18
`hxxp://125.46.198.143:35674/i`	online	malware_download	2026-08-18
`hxxp://115.63.145.245:55982/bin.sh`	online	malware_download	2026-08-18

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["124.131.167.151", "123.11.242.207", "125.46.198.143", "182.121.153.131", "182.121.250.74", "115.55.55.19", "115.63.145.245", "115.55.248.137", "117.223.143.124", "42.239.252.93", "115.63.207.26", "61.53.150.168", "182.116.55.50", "222.140.180.35", "92.124.120.65", "182.116.114.153", "222.139.229.134", "95.165.187.102", "42.234.245.232", "42.235.173.127", "61.54.43.35", "123.14.182.147", "123.14.245.119", "219.155.209.143"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["124.131.167.151", "123.11.242.207", "125.46.198.143", "182.121.153.131", "182.121.250.74", "115.55.55.19", "115.63.145.245", "115.55.248.137", "117.223.143.124", "42.239.252.93", "115.63.207.26", "61.53.150.168", "182.116.55.50", "222.140.180.35", "92.124.120.65", "182.116.114.153", "222.139.229.134", "95.165.187.102", "42.234.245.232", "42.235.173.127", "61.54.43.35", "123.14.182.147", "123.14.245.119", "219.155.209.143"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled

References

URLhaus

False Positive Guidance

Here are the false positive scenarios and corresponding exclusion strategies for the URLhaus: Mozi Malicious URLs detection rule:

Scenario: Security Tool Telemetry & Update Checks
- Context: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) or threat intelligence feeds often poll external repositories to check for signature updates or malware definitions. These tools may query known Mozi-tagged URLs as part of their routine health checks or telemetry ingestion pipelines.
- Filter/Exclusion: Create a whitelist exclusion based on the Source Host being specific security management servers (e.g., falcon-sensor-update.corp.local) and the Process Name matching the agent executable (e.g., C:\Program Files\CrowdStrike\FCSysmon\csagent.exe).
Scenario: Scheduled Backup & Cloud Sync Operations
- Context: Automated backup jobs or cloud synchronization tools (such as Veeam, Rubrik, or OneDrive for Business) frequently access external storage endpoints. If the organization utilizes a Mozi-tagged URL as part of its backup repository infrastructure or a third-party cloud gateway, scheduled nightly syncs will trigger this rule repeatedly during maintenance windows.
- Filter/Exclusion: Apply a time-based exclusion (e.g., 01:00–05:00 UTC) for the Process Name associated with the backup agent (e.g., vbr.exe or OneDrive.exe) when the destination URL matches the Mozi pattern, ensuring alerts only fire outside of maintenance windows.
Scenario: Admin-Driven Software Deployment & Patching
- Context: During scheduled patch cycles, IT administrators using deployment tools like SCCM (System Center Configuration Manager) or Intune may download installer packages from a vendor repository that is tagged as Mozi by URLhaus.