URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt targets the presence of Mozi botnet-associated URLs in network traffic or proxy logs to identify compromised endpoints actively communicating with known malicious infrastructure. Proactively hunting for these indicators is critical because Mozi is a prevalent IoT and server botnet that often serves as a foothold for lateral movement, DDoS attacks, or ransomware deployment, allowing the SOC to isolate affected assets before they are fully leveraged by the adversary.

IOC Summary

Threat: Mozi Total URLs: 5 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["42.237.110.194", "202.1.26.70", "39.74.62.241", "115.49.3.97"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.237.110.194", "202.1.26.70", "39.74.62.241", "115.49.3.97"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A legacy internal application or IoT device (e.g., a specific brand of smart thermostat or industrial controller) that has not been patched for years is configured to poll a known Mozi update endpoint for firmware or configuration updates.
  • Filter/Exclusion: Exclude source IPs belonging to the IoT-Devices or Legacy-Apps AD security group, or exclude specific user agents associated with the known device model (e.g., User-Agent: /Mozi-Client/1.0).
• Scenario: A security team is performing a controlled test of the Mozi botnet’s C2 infrastructure using a dedicated “canary” server or a specific test account to validate detection coverage before a major release.
  • Filter/Exclusion: Exclude traffic from the designated Security-Test-Canary host or the specific sec-test-admin user account, ensuring the exclusion is time-bound or tied to a specific tag in the SIEM.
• Scenario: A developer or QA engineer is debugging a web application that uses a third-party library which, due to a supply chain issue or misconfiguration, inadvertently references a Mozi URL in its error logs or debug output, which is then captured by the hunt package.
  • Filter/Exclusion: Exclude events where the source process is node.exe, python.exe, or java.exe and the destination port is 80 or 443 if the source host is part of the Dev-Cluster or QA-Environment subnet, or exclude if the URL appears in the Response-Body rather than the Request-URI.
• Scenario: A scheduled backup or sync job (e.g., using rsync or a custom PowerShell script) is configured to pull data from a shared folder or external API that is hosted on a server whose IP/URL