URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt hypothesis targets adversary behavior where threat actors leverage Mozi-malicious URLs to deliver payloads or redirect users to phishing campaigns designed to compromise Azure workloads. A SOC team should proactively hunt for these specific indicators in Azure Sentinel to rapidly identify and isolate potential lateral movement or initial access vectors before they escalate into broader security incidents.

IOC Summary

Threat: Mozi Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["125.47.228.36", "115.50.95.179"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["125.47.228.36", "115.50.95.179"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: Mozi Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Vulnerability Scanning by Security Tools

  • Context: Enterprise vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) periodically probe external endpoints to verify SSL certificate validity and web server responsiveness. These tools often generate high volumes of HTTP/HTTPS requests that may hit Mozi-tagged URLs during their discovery phase, triggering the rule despite being benign administrative traffic.
  • Suggested Filter: Create an exclusion based on the Source Host or Process Name. Exclude alerts where the source process matches known scanner executables (e.g., nessus.exe, qualyspcapd.exe) or restrict the rule to exclude traffic originating from dedicated “Security Scanning” IP subnets.

• Scenario: Scheduled Backup and Sync Operations

  • Context: Cloud backup solutions like Veeam, Commvault, or Microsoft Azure Backup frequently connect to external storage gateways or metadata services that may be hosted on domains flagged by URLhaus as Mozi. These scheduled jobs run during off-hours, generating consistent traffic patterns that mimic the “Hunt package” logic for malicious URLs.
  • Suggested Filter: Implement a time-based exclusion or process-specific filter. Exclude alerts generated by backup service accounts (e.g., VeeamBackup.exe, azurbackupagent) occurring within defined maintenance windows (e.g., 02:00–06:00 local time) to reduce noise during routine synchronization cycles.

• Scenario: Software Update and Patch Management

  • Context: Configuration management tools such as Microsoft Endpoint Configuration Manager (SCCM), Jamf, or Ivanti regularly pull