URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where endpoints access known Mozi malware distribution channels via specific malicious URLs to establish initial footholds or deliver payloads. Proactively hunting for these indicators in Azure Sentinel is critical because Mozi’s prevalence as a widespread threat vector requires immediate identification of compromised assets before lateral movement occurs.

IOC Summary

Threat: Mozi Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["42.224.4.31", "115.57.229.124"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.224.4.31", "115.57.229.124"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule in an enterprise environment, along with recommended filters or exclusions:

• Software Update and Patch Management Scans

  • Scenario: Enterprise patch management tools like Microsoft System Center Configuration Manager (SCCM) or Ivanti Endpoint Manager frequently scan vendor repositories to check for the latest security patches. These agents may query known Mozi-associated domains (often used by software vendors) as part of their routine health checks, triggering the rule even though no actual malware is present on the endpoint.
  • Filter/Exclusion: Create an exclusion based on the User Agent string containing specific identifiers for these tools (e.g., *SCCM*, *Ivanti*) or exclude traffic originating from the Service Accounts used by these management servers (e.g., svc-sccm-agent).

• Scheduled Cloud Backup and Synchronization Jobs

  • Scenario: Scheduled backup agents such as Veeam Agent, Acronis Cyber Protect, or cloud sync tools like Microsoft OneDrive for Business often perform background synchronization. If a user has previously accessed a Mozi-tagged URL, the backup agent may re-index or verify the integrity of cached files associated with that domain during its nightly maintenance window, generating multiple hits within the 3-URL threshold.
  • Filter/Exclusion: Exclude traffic generated by specific Process Names (e.g., VeeamAgent.exe, OneDrive.exe) running under the context of the SYSTEM or dedicated backup service accounts during off-hours (e.g., 02:00–06:00 local time).

• Automated Vulnerability Scanning and Compliance Audits

  • Scenario: Internal vulnerability scanners like Tenable Nessus, **