URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hypothesis targets the execution of the Mozi botnet, a prevalent IoT and Linux malware that often propagates via compromised web servers or phishing links, by identifying known malicious URLs associated with its distribution. Proactively hunting for these indicators in Azure Sentinel is critical to detect early-stage infections and prevent the botnet from establishing command-and-control channels or initiating lateral movement within the environment.

IOC Summary

Threat: Mozi Total URLs: 16 Active URLs: 16

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["27.207.230.96", "182.121.150.197", "115.53.195.106", "115.57.245.213", "59.97.248.189", "182.127.70.195", "182.127.125.58", "123.14.220.67", "59.97.248.167", "42.225.200.15", "115.48.150.244", "115.63.13.240", "115.56.156.34", "123.13.2.39", "27.207.188.79", "123.11.65.9"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["27.207.230.96", "182.121.150.197", "115.53.195.106", "115.57.245.213", "59.97.248.189", "182.127.70.195", "182.127.125.58", "123.14.220.67", "59.97.248.167", "42.225.200.15", "115.48.150.244", "115.63.13.240", "115.56.156.34", "123.13.2.39", "27.207.188.79", "123.11.65.9"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses curl or wget to download a specific Mozi-infected binary or configuration file from a known URL for local analysis, debugging, or creating a test fixture in a non-production environment.
  • Filter/Exclusion: Exclude alerts where the source process is curl.exe, wget.exe, or powershell.exe and the destination path contains keywords like \test\, \dev\, \sandbox\, or \analysis\.
• Scenario: An IT administrator performs a manual vulnerability scan or integrity check using a tool like Nessus or Qualys that references a list of known malicious URLs (including Mozi) to verify if any internal hosts are still fetching resources from them.
  • Filter/Exclusion: Exclude alerts where the source process is a known scanning agent (e.g., nessus.exe, qualys_agent.exe) or where the user account belongs to the Service_Accounts or Scanner group.
• Scenario: A scheduled PowerShell script or batch job used for log rotation or data archival inadvertently references a Mozi URL as a placeholder, example, or in a comment block that is being parsed by a monitoring agent.
  • Filter/Exclusion: Exclude alerts where the source process is cmd.exe or powershell.exe and the command line contains keywords like logrotate, archive, backup, or cleanup.
• Scenario: A web application or API gateway uses a Mozi URL as a default fallback endpoint or in a configuration file for a feature that is currently disabled or in maintenance mode, leading to occasional health check pings.
  • Filter/Exclusion: Exclude alerts where the source process is a web server (e.g., w3wp.exe, nginx.exe, apache.exe) and the user account is