URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This rule detects the presence of known Mozi botnet command-and-control URLs, indicating that an adversary is actively communicating with or downloading payloads from a compromised infrastructure. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify compromised endpoints early, preventing the Mozi botnet from establishing persistence and executing lateral movement across the network.

IOC Summary

Threat: Mozi Total URLs: 11 Active URLs: 7

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["182.126.107.136", "219.157.161.10", "27.210.249.141", "112.246.19.248", "70.166.118.40", "27.210.37.1"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.126.107.136", "219.157.161.10", "27.210.249.141", "112.246.19.248", "70.166.118.40", "27.210.37.1"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: Older internal web applications or API gateways (e.g., legacy .NET or Java services) may use hardcoded Mozi-associated domains for health checks, version verification, or license validation.
  • Filter/Exclusion: Exclude known internal service accounts (e.g., svc-app-health, api-gateway-admin) or specific source IPs belonging to the application server cluster from the URL match criteria.
• CI/CD Pipeline Artifact Retrieval: Continuous Integration/Continuous Deployment (CI/CD) systems (e.g., Jenkins, GitLab CI, Azure DevOps) might pull build artifacts, dependencies, or configuration files from a repository or artifact registry that has been compromised or is using a Mozi-tagged domain for temporary file hosting.
  • Filter/Exclusion: Exclude processes associated with build agents (e.g., jenkins-agent, gitlab-runner, azure-devops-agent) or specific user contexts (e.g., ci-service-account) when the URL request originates from the build server subnet.
• Scheduled Backup or Sync Jobs: Scheduled tasks (e.g., Windows Task Scheduler, cron jobs) for backup solutions (e.g., Veeam, Commvault) or file synchronization tools (e.g., Synology Drive, Nextcloud) might connect to Mozi-tagged URLs if the backup repository or sync endpoint has been misconfigured or if a third-party plugin uses these domains for metadata retrieval.
  • Filter/Exclusion: Exclude processes running under backup service accounts (e.g., svc-backup, commvault-agent) or specific scheduled task names (e.g., Daily-Backup-Job, Sync-Files) from the detection logic.
• Browser Extension or Plugin Updates: Enterprise browsers (e.g., Chrome, Edge) with auto-updating extensions or plugins (e.g., ad-blockers, password managers