URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt targets the presence of known Mozi botnet URLs, which are frequently used for command-and-control communications or initial payload delivery in IoT and server environments. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised assets early, preventing the Mozi botnet from establishing persistent footholds and propagating lateral movement across the network.

IOC Summary

Threat: Mozi Total URLs: 4 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["182.112.29.95", "222.142.240.141"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.112.29.95", "222.142.240.141"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: Older internal web applications or IoT gateways may still reference deprecated Mozi-related endpoints for status polling or legacy API compatibility.
  • Filter: Exclude traffic from known legacy application service accounts or specific internal IP ranges (e.g., 10.20.50.0/24) where the User-Agent string matches the legacy app identifier (e.g., LegacyHealthCheck/1.0).
• Scheduled Backup Verification Jobs: Cron jobs or scheduled tasks in backup software (e.g., Veeam, Commvault) might use a generic URL template that coincidentally matches one of the Mozi URLs if the backup repository URL was misconfigured or if a test endpoint was left in the configuration.
  • Filter: Exclude events where the source process is a known backup agent (e.g., vssadmin.exe, commvaultagent.exe) or where the event correlates with a scheduled task ID associated with backup operations.
• Development Environment Testing: Developers in staging or QA environments may intentionally use these URLs as dummy endpoints for integration testing of URL parsing libraries or HTTP client modules.
  • Filter: Exclude hosts or users tagged with Environment=Dev or Environment=QA in the asset inventory, or exclude traffic where the User-Agent contains DevTest or QA-Client.
• Browser Extension or Plugin Caching: Certain browser extensions or legacy plugins may cache or prefetch URLs during initialization, potentially hitting these known Mozi URLs if they are used as placeholder examples in documentation or code comments that get inadvertently fetched.
  • Filter: Exclude events where the source process is a browser executable (e.g., chrome.exe, firefox.exe) and the request method is HEAD or OPTIONS (common for prefetching/caching) rather than GET or POST.
• **DNS Resolution