URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt detects adversary activity involving traffic to known Mozi malware distribution URLs, which are frequently used in supply chain attacks and drive-by downloads to compromise endpoints. A SOC team should proactively hunt for these indicators in Azure Sentinel to identify early-stage infections before the malware executes its persistence mechanisms or lateral movement capabilities within the network.

IOC Summary

Threat: Mozi Total URLs: 7 Active URLs: 7

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["222.138.117.213", "221.15.214.165", "42.235.183.167", "123.8.162.45", "105.158.197.238", "59.180.144.211"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["222.138.117.213", "221.15.214.165", "42.235.183.167", "123.8.162.45", "105.158.197.238", "59.180.144.211"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: Mozi Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) perform routine web crawling and may probe known malicious URL patterns to test proxy configurations or firewall rules. These tools often generate high-volume traffic that mimics the signature of Mozi activity but is purely diagnostic.
  • Filter/Exclusion: Exclude source IP ranges belonging to internal security appliances (e.g., 10.20.50.0/24 for Tenable scanners) or filter out events where the user agent string contains specific keywords like “Tenable-Nessus” or “QualysCloudAgent”.

• Scenario: Scheduled Cloud Backup and Sync Operations

  • Context: Enterprise backup solutions (e.g., Veeam, Rubrik, or Microsoft Azure Backup) often utilize cloud storage endpoints that share URL structures with the Mozi campaign. During nightly scheduled jobs, these agents initiate connections to external S3 buckets or CDN nodes that may be flagged by the rule due to shared domain patterns.
  • Filter/Exclusion: Create an exclusion based on the Scheduled Job name (e.g., “Nightly Cloud Sync”) and exclude traffic from backup service accounts (e.g., svc-backup-agent) during defined maintenance windows (e.g., 02:00–04:00 UTC).

• Scenario: Developer CI/CD Pipeline Artifacts

  • Context: Continuous Integration platforms like GitLab, Jenkins, or GitHub Actions frequently pull dependencies and deploy artifacts from external repositories. If the Mozi detection logic relies on specific URL patterns that overlap with popular