URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt targets adversaries leveraging Mozi malware to establish command-and-control channels via known malicious web endpoints, enabling initial infection or lateral movement. Proactively hunting these specific URL patterns in Azure Sentinel is critical because early detection of Mozi traffic allows SOC teams to isolate compromised assets before the malware executes its full payload and exfiltrates sensitive data.

IOC Summary

Threat: Mozi Total URLs: 6 Active URLs: 6

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["115.54.121.49", "222.137.80.156", "61.52.37.247", "125.45.9.133", "115.56.102.218"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["115.54.121.49", "222.137.80.156", "61.52.37.247", "125.45.9.133", "115.56.102.218"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule in an enterprise environment, along with recommended filters or exclusions:

• Automated Software Update Scans by Endpoint Protection Agents

  • Scenario: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) periodically scan their own update servers and cloud repositories. These agents often query URLhaus directly to validate the integrity of new signature packages, triggering hits on Mozi-tagged URLs that are actually part of the vendor’s trusted supply chain.
  • Filter/Exclusion: Create an exclusion rule based on Process Name (e.g., C:\Program Files\CrowdStrike\FalconSensor.exe or MsMpEng.exe) and restrict the alert to exclude traffic originating from the specific Internal IP Subnet of the Endpoint Management Servers.

• Scheduled Vulnerability Scans by Network Security Appliances

  • Scenario: Scheduled vulnerability assessments run nightly using tools like Tenable Nessus, Qualys, or Rapid7 InsightVM. During these scans, the scanner probes external threat intelligence feeds (including URLhaus) to benchmark against known malicious domains. The scanner’s service account generates high-volume HTTP/HTTPS requests to Mozi URLs as part of its baseline data collection routine.
  • Filter/Exclusion: Implement a filter that excludes alerts where the Source User is a dedicated service account (e.g., svc-tenable-scan or qualys-agent) and the Destination Port matches standard scanning ports, specifically during the scheduled maintenance window (e.g., 02:00–04:00 UTC).

• IT Administration Tasks Involving Threat Intelligence Dashboards

  • Scenario: Security analysts or IT administrators manually accessing threat