URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where attackers leverage known malicious URLs from the Mozi malware family to deliver payloads or redirect victims to phishing sites via URLhaus intelligence feeds. A SOC team should proactively hunt for this in Azure Sentinel because Mozi’s high severity and prevalence as a banking trojan necessitate early identification of compromised endpoints before lateral movement or credential theft occurs.

IOC Summary

Threat: Mozi Total URLs: 16 Active URLs: 15

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["42.235.50.219", "42.225.220.81", "42.234.186.105", "125.42.193.159", "47.215.224.64", "182.119.120.150", "182.121.162.111", "125.44.18.255", "110.36.72.194", "182.117.68.188", "110.37.43.119", "222.137.39.216", "219.155.228.87"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.235.50.219", "42.225.220.81", "42.234.186.105", "125.42.193.159", "47.215.224.64", "182.119.120.150", "182.121.162.111", "125.44.18.255", "110.36.72.194", "182.117.68.188", "110.37.43.119", "222.137.39.216", "219.155.228.87"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule in an enterprise environment, including suggested filters and exclusions:

• Scenario: Scheduled Antivirus Definition Updates via Cloud Repositories

  • Context: Enterprise endpoints (e.g., Microsoft Defender for Endpoint or CrowdStrike) automatically pull definition updates from cloud repositories. These update servers often host dynamic URLs that may be newly registered or shared across multiple tenants, triggering Mozi’s heuristic analysis as “suspicious” due to low reputation scores on first access.
  • Filter/Exclusion: Create a whitelist exclusion for the specific update server domains (e.g., *.update.microsoft.com, *.crowdstrike.com) within the URLhaus integration or the EDR policy, ensuring traffic from these known-good sources bypasses Mozi’s deep inspection logic.

• Scenario: Admin Deployment of Third-Party SaaS Applications

  • Context: During onboarding or software rollout, IT administrators deploy new SaaS tools (e.g., Zoom, Slack, ServiceNow) to user groups. The initial “first-touch” URL often lacks a historical reputation score in the Mozi database, causing the detection engine to flag legitimate deployment traffic as potentially malicious until the URL is fully indexed.
  • Filter/Exclusion: Implement a time-based suppression rule that excludes alerts for URLs belonging to approved SaaS categories (via CASB integration) during business hours (08:00–18:00), or configure the rule to ignore “New Domain” flags if the source IP belongs to a trusted corporate subnet.

• Scenario: Automated Backup and Archive Retrieval Jobs

  • Context: Nightly scheduled jobs initiated by backup appliances (e.g., Veeam, Commvault) connect to external cloud storage buckets (AWS S3, Azure Blob) to retrieve or