URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hypothesis targets the Mozi botnet, a prevalent Linux-based threat that leverages known malicious URLs to facilitate command-and-control communications or initial payload delivery. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC to identify compromised assets before the botnet can propagate laterally or execute its typical IoT and server exploitation tactics.

IOC Summary

Threat: Mozi Total URLs: 16 Active URLs: 15

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["175.107.16.92", "222.138.213.73", "125.41.3.2", "42.230.46.20", "115.63.13.240", "182.127.114.101", "115.63.50.214", "125.40.120.120", "123.9.95.170", "175.107.229.199", "42.231.228.249", "103.179.240.227", "119.189.215.19"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["175.107.16.92", "222.138.213.73", "125.41.3.2", "42.230.46.20", "115.63.13.240", "182.127.114.101", "115.63.50.214", "125.40.120.120", "123.9.95.170", "175.107.229.199", "42.231.228.249", "103.179.240.227", "119.189.215.19"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: Older internal web applications (e.g., legacy Java-based portals or custom .NET apps) may have hardcoded health check endpoints or debug pages that reference known Mozi URLs for testing connectivity or loading specific assets.
  • Filter/Exclusion: Exclude traffic from specific legacy application server IP ranges or process names (e.g., java.exe, dotnet.exe) where the destination URL matches the Mozi list but the source is an internal application server rather than a user workstation.
• Developer Localhost Testing: Developers working on web projects that integrate with third-party services or use mock servers might locally host or reference these URLs in localhost configurations, Docker containers, or local IIS/Apache setups for unit testing.
  • Filter/Exclusion: Exclude events where the source IP is within the developer subnet (e.g., 10.20.0.0/24) and the process is a known development tool (e.g., node.exe, python.exe, docker.exe) or the destination port is 80/443 from a non-browser process.
• Scheduled Backup or Sync Jobs: Automated backup scripts or data synchronization tools (e.g., rsync, robocopy, or custom PowerShell scripts) might archive web content or logs that include these URLs as part of a broader data snapshot, triggering network connection alerts if the tool makes outbound calls to validate checksums or metadata.
  • Filter/Exclusion: Exclude connections initiated by service accounts associated with backup jobs (e.g., svc-backup, backup-agent) or processes like vssadmin.exe, wbadmin.exe, or robocopy.exe when the destination matches the Mozi URL list.
• Browser Extension or Plugin Updates: Certain browser extensions (e.g., ad-blockers, developer tools, or