URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hypothesis targets the Mozi malware family, a backdoor that establishes remote command execution and data exfiltration channels through malicious URLs often delivered via phishing campaigns. Proactively hunting for these URLs in Azure Sentinel allows the SOC team to identify compromised endpoints early, preventing the malware from achieving persistence and exfiltrating sensitive data before it spreads laterally within the environment.

IOC Summary

Threat: Mozi Total URLs: 4 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["42.231.47.159"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.231.47.159"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A legacy internal application server (e.g., running Apache Tomcat or IIS) initiates a periodic health check or telemetry upload to a known Mozi C2 domain that was previously whitelisted in the corporate proxy but later reclassified by URLhaus due to a new variant.
  • Filter/Exclusion: Exclude outbound connections from the specific server-app-legacy host group if the destination IP is within the internal 10.0.0.0/8 range or if the User-Agent string contains LegacyHealthCheck/1.0.
• Scenario: A developer on the QA team manually tests a new microservice by curling a public Mozi URL to verify that the service’s outbound proxy configuration is correctly routing traffic, triggering the rule during a scheduled deployment pipeline.
  • Filter/Exclusion: Exclude alerts where the source process is curl.exe or wget.exe and the initiating user account belongs to the qa-automation AD group, provided the connection occurs during the defined DeploymentWindow (e.g., 02:00–04:00 UTC).
• Scenario: An endpoint running a popular open-source monitoring agent (e.g., Prometheus Node Exporter or Datadog Agent) fetches a configuration file or metric definition from a URL that happens to be hosted on a domain recently flagged by URLhaus as Mozi-associated, despite the domain being a legitimate CDN for that tool.
  • Filter/Exclusion: Exclude alerts where the source process is node_exporter or datadog-agent and the destination URL path contains /metrics/ or /config/, verifying that the TLS certificate chain matches the known datadoghq.com or prometheus.io CA.
• Scenario: A shared test VM used by the security team to validate new detection rules