URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt targets the presence of known Mozi botnet command-and-control URLs, which are frequently used to establish persistence and exfiltrate data from compromised IoT and server devices. Proactively hunting for these indicators in Azure Sentinel is critical because Mozi is a prevalent threat in cloud environments, and early detection prevents the botnet from propagating laterally or executing additional payloads against your infrastructure.

IOC Summary

Threat: Mozi Total URLs: 10 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["182.117.68.170", "182.126.124.244", "182.114.193.191"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.117.68.170", "182.126.124.244", "182.114.193.191"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: Older internal web applications or IoT gateways may still reference deprecated Mozi-related endpoints for status pings or legacy API compatibility.
  • Filter/Exclusion: Exclude requests from specific service accounts (e.g., svc-app-healthcheck) or limit the rule to non-200/204 HTTP response codes to ignore successful health checks.
• Developer Localhost Testing: Developers running local instances of Mozi-based services or using Mozi URLs in localhost or 127.0.0.1 configurations during unit/integration testing.
  • Filter/Exclusion: Exclude traffic where the source IP is within the developer subnet (e.g., 10.20.0.0/24) or where the Host header contains localhost or 127.0.0.1.
• Scheduled Backup/Log Rotation Jobs: Cron jobs or scheduled tasks that archive old logs or configuration files containing Mozi URL strings into backup repositories or log aggregation systems (e.g., Splunk, ELK).
  • Filter/Exclusion: Exclude events where the user agent is a known backup tool (e.g., Veeam, Commvault) or where the source process is a scheduled task service (e.g., Task Scheduler on Windows, cron on Linux).
• Security Tooling Scans: Vulnerability scanners (e.g., Nessus, Qualys) or DAST tools (e.g., OWASP ZAP) actively probing known Mozi URLs to verify patch status or detect exposed endpoints.
  • Filter/Exclusion: Exclude traffic from known scanner IP ranges or where the User-Agent string contains identifiers like Nessus, Qualys, or ZAP.
• Documentation/Training Portals: Internal Confluence, SharePoint,