URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt targets adversary activity where compromised endpoints establish outbound connections to known malicious URLs associated with the Mozi malware family, indicating potential backdoor installation for command-and-control communication and data exfiltration. Proactively hunting for these specific URL patterns in Azure Sentinel is critical because early detection of Mozi’s C2 channels allows the SOC team to isolate infected assets before sensitive data is fully extracted or lateral movement occurs within the network.

IOC Summary

Threat: Mozi Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["59.103.116.68", "42.228.36.34", "115.62.58.252"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["59.103.116.68", "42.228.36.34", "115.62.58.252"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• IT Asset Management & Patch Deployment Scans

  • Scenario: Enterprise patch management tools (e.g., Microsoft Endpoint Configuration Manager, Ivanti Neurons, or SolarWinds Patch Manager) frequently scan internal endpoints and external repositories. During routine inventory checks, these agents may query known software vendor update servers that host Mozi-related signatures or share IP ranges with the malicious C2 infrastructure, triggering alerts on benign HTTP/HTTPS traffic.
  • Suggested Filter: Create an exclusion for traffic originating from specific Service Accounts (e.g., svc-patch-deploy, agent-scanner) and restrict the rule to exclude traffic destined for known internal IP ranges or whitelisted vendor domains (e.g., *.microsoft.com, *.solarwinds.com).

• Automated Compliance & Security Scanning Jobs

  • Scenario: Scheduled vulnerability scanners (such as Tenable Nessus, Qualys, or Rapid7 InsightVM) run nightly jobs to probe external web resources. These tools often perform deep packet inspection and URL categorization, which can result in the scanner’s own traffic hitting a Mozi-associated domain while validating SSL certificates or checking for known threat intelligence feeds, mimicking the C2 beacon behavior of the malware.
  • Suggested Filter: Implement a time-based exclusion during scheduled maintenance windows (e.g., 02:00 - 04:00 UTC) and filter out traffic where the User-Agent string contains specific scanner identifiers (e.g., containing “Nessus”, “QualysAgent”, or “InsightVM”).

• Software Supply Chain & Dependency Updates

  • Scenario: Development