URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hypothesis targets the execution of the Mozi botnet, a prevalent Linux-based malware often used for cryptocurrency mining and DDoS attacks, by correlating network traffic against known malicious URLs. Proactively hunting for these indicators in Azure Sentinel is critical to identify compromised workloads or containers that are communicating with Mozi command-and-control infrastructure before they can establish persistence or spread laterally within the environment.

IOC Summary

Threat: Mozi Total URLs: 10 Active URLs: 8

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["182.127.114.159", "222.142.247.141", "61.53.149.8", "125.41.6.16", "42.232.234.77"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.127.114.159", "222.142.247.141", "61.53.149.8", "125.41.6.16", "42.232.234.77"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., Jenkins or GitHub Actions) to deploy a microservice that dynamically fetches configuration or feature flags from a staging environment URL that happens to be listed in the Mozi dataset due to a recent compromise or shared infrastructure.

  • Filter/Exclusion: Exclude network connections where the source process is a known CI/CD agent (e.g., jenkins-agent.exe, dockerd.exe, kubelet) or where the destination port is 443 and the User-Agent header contains Jenkins or GitHub-Actions.

• Scenario: An internal API gateway or service mesh (e.g., Istio, Linkerd) routes traffic to a backend service that is temporarily hosted on a cloud IP address or domain that has been flagged by URLhaus as Mozi-related, often because the service was previously compromised or shares a C2 infrastructure with known Mozi variants.

  • Filter/Exclusion: Exclude connections where the source process is a service mesh sidecar (e.g., envoyproxy, linkerd-proxy) or where the destination is an internal Kubernetes Service ClusterIP or a known internal load balancer IP range.

• Scenario: A security testing team performs a penetration test or chaos engineering exercise using a tool like curl or wget to validate endpoint availability against a list of known malicious URLs to ensure detection coverage, including the specific Mozi URLs in the hunt package.

  • Filter/Exclusion: Exclude connections where the source process is a common HTTP client (curl.exe, wget.exe, powershell.exe with -Command) and the command line arguments contain test-specific flags (e.g., -o /dev/null, --head, or a custom header like X-SOC-Test: true).

• Scenario: A legacy application or third