URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hypothesis targets the presence of known Mozi botnet command-and-control URLs, which are frequently used to establish persistent backdoors on compromised IoT and Linux devices. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify potentially infected endpoints or network traffic patterns before the botnet can execute lateral movement or launch distributed denial-of-service attacks.

IOC Summary

Threat: Mozi Total URLs: 6 Active URLs: 6

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["61.144.102.27", "123.5.135.197", "42.224.126.73", "42.234.154.16"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["61.144.102.27", "123.5.135.197", "42.224.126.73", "42.234.154.16"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., Jenkins or GitLab CI) to deploy a containerized application that includes a health check script or initialization routine referencing one of the Mozi URLs for version verification or dependency fetching.
  • Filter/Exclusion: Exclude network connections where the source process is a known CI/CD agent (e.g., jenkins-agent.exe, gitlab-runner, dockerd) or where the destination IP resolves to a known internal registry/proxy, and the source port is ephemeral (dynamic) rather than a standard service port.
• Scenario: An automated backup or snapshot job (e.g., Veeam, Commvault, or AWS Backup) captures a database or file share that contains a configuration file or log entry referencing the Mozi URL, and the backup agent re-connects to the source to verify data integrity or fetch metadata.
  • Filter/Exclusion: Exclude traffic where the source process is a backup agent (e.g., vbragent.exe, commvault_agent.exe, awsbackupagent.exe) and the destination is an internal storage cluster or cloud endpoint, specifically filtering out connections where the User-Agent header or process name indicates backup operations.
• Scenario: A security team performs a controlled test or validation of a new web application firewall (WAF) or proxy rule by intentionally accessing the Mozi URLs from a designated test server to confirm blocking/allowing behavior.
  • Filter/Exclusion: Exclude connections originating from a specific IP range or subnet designated for security testing (e.g., 10.20.50.0/24) or where the source hostname matches a known test server pattern (e.g., sec-test-*), and the connection occurs during a scheduled maintenance window.
• Scenario: A legacy application or service uses a hardcoded URL