URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where compromised endpoints attempt to access known Mozi malware distribution URLs, indicating potential initial infection or command-and-control communication. Proactively hunting for these specific URL patterns in Azure Sentinel is critical because early detection of Mozi activity allows the SOC team to isolate affected assets before the malware establishes persistence and begins lateral movement across the network.

IOC Summary

Threat: Mozi Total URLs: 5 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["61.52.159.219", "110.36.30.112", "182.116.12.154"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["61.52.159.219", "110.36.30.112", "182.116.12.154"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule in an enterprise environment, along with recommended filters and exclusions:

• Scheduled Security Scanner Updates

  • Scenario: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon or SentinelOne) performs a scheduled daily update of its threat intelligence feeds. During this process, the scanner queries multiple Mozi-tagged URLs to verify signature validity and download new definitions, triggering alerts on the falcon-updater service account rather than user workstations.
  • Filter/Exclusion: Create an exclusion rule that suppresses alerts for traffic originating from known security management servers (e.g., IP range 10.20.50.0/24) or specifically excludes the process names falcon-sensor.exe and sentinel-agent.exe.

• IT Asset Management & Discovery Scans

  • Scenario: The IT Operations team runs a quarterly network discovery job using SolarWinds NPM or ** Lansweeper**. These tools actively probe external endpoints to map the corporate asset inventory, including checking the status of third-party vendor portals. When these scanners hit Mozi-tagged URLs associated with software vendors (e.g., Microsoft Update servers or Adobe Cloud), they generate high-volume hits that mimic malicious browsing behavior.
  • Filter/Exclusion: Exclude traffic from specific service accounts used for discovery (e.g., svc_lansweeper, svc_solarwinds) and filter out URLs containing known vendor domains (e.g., *.update.microsoft.com, *.adobe.io) if the source IP belongs to the internal management subnet.

• Automated Compliance Reporting Jobs

  • Scenario: A nightly compliance job executed by ServiceNow or a custom Python script on a dedicated Linux bastion