URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt detects adversary activity involving the Mozi malware family by identifying network traffic to a curated set of 15 known malicious URLs associated with its command and control infrastructure. Proactively hunting for these indicators in Azure Sentinel is critical due to the high severity of Mozi’s potential impact, allowing the SOC team to rapidly isolate compromised endpoints before lateral movement or data exfiltration occurs.

IOC Summary

Threat: Mozi Total URLs: 15 Active URLs: 14

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["59.96.139.113", "182.112.89.53", "182.113.44.60", "61.53.120.157", "123.12.177.12", "123.9.195.116", "115.62.135.216", "182.126.248.10", "115.57.212.220", "41.201.226.25"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["59.96.139.113", "182.112.89.53", "182.113.44.60", "61.53.120.157", "123.12.177.12", "123.9.195.116", "115.62.135.216", "182.126.248.10", "115.57.212.220", "41.201.226.25"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Security Scanning by EDR Agents

  • Context: Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon or Microsoft Defender for Endpoint frequently perform periodic background scans of known threat intelligence feeds. These agents often query the urlhaus.abusix.com API directly to validate local cache data, triggering hits against Mozi-tagged URLs that are part of their internal validation logic rather than user-initiated browsing.
  • Filter/Exclusion: Create a rule exclusion based on the Process Name and User Context. Exclude alerts where Process_Name matches FalconSensor.exe, MsMpEng.exe, or DefenderService.exe AND Logon_User is a service account (e.g., NT SERVICE\... or SYSTEM).

• Scenario: Scheduled Backup and Sync Operations

  • Context: Enterprise backup solutions such as Veeam Backup & Replication or cloud sync tools like OneDrive for Business often include health check scripts that ping external security repositories. During nightly maintenance windows, these services may query Mozi URLs to verify connectivity and update their local threat databases, generating traffic that mimics a malicious URL interaction.
  • Filter/Exclusion: Implement a time-based exclusion window combined with service account filtering. Exclude alerts occurring between 01:00 AM and 05:00 AM (local time) where the Source_User belongs to the Backup-Service-Accounts group or specific scheduled task accounts like VeeamBkpSvc.

• Scenario: IT Admin Manual Threat Intelligence Review

  • Context: Security Operations Center