URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt targets the presence of known Mozi botnet URLs, which adversaries use to establish command-and-control channels or deliver payloads to compromised hosts. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify potentially infected endpoints or web proxies before the botnet can propagate laterally or execute malicious tasks within the environment.

IOC Summary

Threat: Mozi Total URLs: 5 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["42.224.7.191", "98.252.87.232", "27.215.84.127"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.224.7.191", "98.252.87.232", "27.215.84.127"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Automated Patch Management and Update Verification

  • Scenario: Enterprise patch management tools (e.g., SCCM, Ansible, or custom PowerShell scripts) may fetch specific version manifests or checksums from known endpoints to verify update integrity. If a Mozi-tagged URL is used as a temporary staging point or is part of a shared library repository that has been compromised or reused, automated agents polling these endpoints will trigger the rule.
  • Filter/Exclusion: Exclude network connections where the source process is a known patch management agent (e.g., CcmExec.exe, Ansible.exe, or PowerShell.exe with specific command-line arguments related to updates) and the destination port is 443/80. Alternatively, whitelist the specific IP addresses associated with the internal patch distribution server if the URLs resolve to internal infrastructure.

• CI/CD Pipeline Artifact Downloading

  • Scenario: Continuous Integration/Continuous Deployment (CI/CD) systems (e.g., Jenkins, GitLab CI, Azure DevOps) often download build artifacts, dependencies, or container images from remote repositories. If a developer or build script references a URL that matches one of the Mozi-tagged entries (perhaps due to a shared public repository or a misconfigured artifact registry), the build agent will initiate a connection to that URL during the build or deploy phase.
  • Filter/Exclusion: Exclude connections originating from CI/CD agent processes (e.g., jenkins-agent.exe, gitlab-runner, azure-pipelines-agent) when the destination URL matches the Mozi list and the source machine is identified as a build server or CI/CD node in the asset inventory.

• Scheduled Data Backup or Sync Jobs

  • Scenario: Scheduled backup or file synchronization tools (e.g., Veeam, Rubrik, or custom rsync/