This rule detects adversary behavior involving the exploitation of Mozi-tagged malicious URLs to deliver payloads that compromise endpoint integrity within the network. A SOC team should proactively hunt for these indicators in Azure Sentinel because early identification of Mozi-associated traffic allows for rapid containment before lateral movement or data exfiltration occurs.
Threat: Mozi Total URLs: 46 Active URLs: 46
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://221.15.7.244:38891/i | online | malware_download | 2026-08-29 |
hxxp://42.234.233.72:38508/bin.sh | online | malware_download | 2026-08-29 |
hxxp://125.41.6.152:46245/bin.sh | online | malware_download | 2026-08-29 |
hxxp://182.126.204.148:48244/bin.sh | online | malware_download | 2026-08-29 |
hxxp://171.125.204.163:12907/i | online | malware_download | 2026-08-29 |
hxxp://115.60.208.32:52950/i | online | malware_download | 2026-08-29 |
hxxp://125.47.92.240:35468/bin.sh | online | malware_download | 2026-08-29 |
hxxp://112.239.123.90:59150/bin.sh | online | malware_download | 2026-08-29 |
hxxp://182.116.118.56:58412/i | online | malware_download | 2026-08-29 |
hxxp://42.227.238.137:55865/bin.sh | online | malware_download | 2026-08-29 |
hxxp://123.12.195.221:46881/bin.sh | online | malware_download | 2026-08-29 |
hxxp://115.58.93.144:55797/i | online | malware_download | 2026-08-29 |
hxxp://171.125.204.163:12907/bin.sh | online | malware_download | 2026-08-29 |
hxxp://115.60.208.32:52950/bin.sh | online | malware_download | 2026-08-29 |
hxxp://124.131.158.244:55504/i | online | malware_download | 2026-08-29 |
hxxp://222.138.101.213:34074/bin.sh | online | malware_download | 2026-08-29 |
hxxp://115.50.1.231:33440/bin.sh | online | malware_download | 2026-08-29 |
hxxp://123.9.242.26:52522/i | online | malware_download | 2026-08-29 |
hxxp://119.179.248.180:39560/i | online | malware_download | 2026-08-29 |
hxxp://222.139.194.121:37916/bin.sh | online | malware_download | 2026-08-29 |
hxxp://115.49.232.111:48058/i | online | malware_download | 2026-08-29 |
hxxp://182.127.121.121:54660/bin.sh | online | malware_download | 2026-08-29 |
hxxp://182.116.55.159:32934/bin.sh | online | malware_download | 2026-08-29 |
hxxp://222.141.75.2:47007/i | online | malware_download | 2026-08-29 |
hxxp://222.141.112.133:41245/i | online | malware_download | 2026-08-29 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["123.12.195.221", "112.239.123.90", "182.127.121.121", "182.116.55.159", "222.139.194.121", "182.116.118.56", "115.49.232.111", "125.47.92.240", "42.227.238.137", "222.138.101.213", "119.179.248.180", "124.131.158.244", "115.58.93.144", "115.50.1.231", "115.63.241.158", "222.141.112.133", "222.141.75.2", "42.234.233.72", "125.41.6.152", "182.126.204.148", "182.126.141.140", "115.60.208.32", "123.9.242.26", "221.15.7.244", "171.125.204.163"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["123.12.195.221", "112.239.123.90", "182.127.121.121", "182.116.55.159", "222.139.194.121", "182.116.118.56", "115.49.232.111", "125.47.92.240", "42.227.238.137", "222.138.101.213", "119.179.248.180", "124.131.158.244", "115.58.93.144", "115.50.1.231", "115.63.241.158", "222.141.112.133", "222.141.75.2", "42.234.233.72", "125.41.6.152", "182.126.204.148", "182.126.141.140", "115.60.208.32", "123.9.242.26", "221.15.7.244", "171.125.204.163"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 3-5 specific false positive scenarios and corresponding filters for the URLhaus: Mozi Malicious URLs detection rule in an enterprise environment:
Scenario: Automated Security Tool Health Checks
SourceUser = 'SYSTEM' AND ProcessName = 'falcon.sysmon.exe'). Alternatively, create a whitelist for the specific IP addresses of the security vendor’s update servers if they are known to query these URLs.Scenario: Scheduled Backup and Compliance Scans
IF (ProcessName IN ['Veeam.Backup.Service.exe', 'QualysAgent.exe']) AND (TimeOfDay BETWEEN 01:00 AND 05:00) THEN Suppress Alert. This ensures alerts only trigger during business hours when user activity is expected, or specifically for non-backup processes.Scenario: Admin-Driven Software Deployment and Patching *