URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt targets the presence of known Mozi botnet command-and-control URLs, which adversaries use to establish persistent remote access and execute malicious payloads on compromised hosts. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify potentially infected assets before the botnet can propagate laterally or initiate large-scale DDoS attacks.

IOC Summary

Threat: Mozi Total URLs: 5 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["182.126.116.12", "42.226.67.57", "222.142.253.114", "27.215.124.53"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.126.116.12", "42.226.67.57", "222.142.253.114", "27.215.124.53"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: An older internal inventory management system (e.g., a custom ASP.NET app) uses a hardcoded health check script that pings a known Mozi URL to verify outbound internet connectivity before processing batch jobs.
  • Filter: Exclude the specific service account (e.g., svc-inventory-app) or the source IP range of the legacy application server from the URL match.
• Third-Party SaaS Integration Webhooks: A CRM integration tool (e.g., Zapier or a custom Python script) uses a Mozi-tagged URL as a temporary staging endpoint for payload validation during a one-time data migration project.
  • Filter: Exclude the specific user account running the migration script (e.g., admin-data-migration) or limit the alert to only trigger if the URL is accessed by more than 5 unique hosts within a 1-hour window.
• Scheduled Backup Verification Job: A nightly scheduled task (e.g., BackupVerify.bat) initiated by the backup service account (svc-backup) makes a GET request to a Mozi URL to confirm that the backup repository is reachable and not blocked by the firewall.
  • Filter: Exclude the svc-backup service account or the specific scheduled task name (\Backup\VerifyConnectivity) from the detection logic.
• Developer Local Testing Environment: A developer on a jump host or dev VM uses a local proxy (e.g., Fiddler or Charles Proxy) to intercept and test API responses, where the Mozi URL is used as a test endpoint in a local hosts file or proxy rule.
  • Filter: Exclude hosts tagged with dev or test in the asset inventory, or exclude traffic originating from the developer’s specific workstation IP if it is within the dev subnet (e.g., `10.20.0.0/2