URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging Mozi malware to establish persistent backdoor access through phishing campaigns that deliver malicious URLs for remote command execution and data exfiltration. Proactively hunting for these indicators in Azure Sentinel is critical because early detection of Mozi’s initial infection vector allows the SOC team to isolate compromised endpoints before attackers can execute lateral movement or sensitive data theft operations.

IOC Summary

Threat: Mozi Total URLs: 8 Active URLs: 6

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["123.14.73.174", "61.53.219.139", "112.238.178.200", "42.235.6.8"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["123.14.73.174", "61.53.219.139", "112.238.178.200", "42.235.6.8"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Automated Security Scanning by EDR Agents

  • Context: Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon or Microsoft Defender for Endpoint periodically scan their own update servers or internal threat intelligence feeds. These agents often initiate HTTP/HTTPS requests to Mozi-related URLs hosted on the vendor’s cloud infrastructure to check for signature updates, which can mimic the initial infection vector of the Mozi backdoor.
  • Filter/Exclusion: Create a rule exclusion based on the Process Name and User Account. Exclude traffic where the process is C:\Program Files\CrowdStrike\csagent.exe (or equivalent EDR binary) running under the local system account (NT AUTHORITY\SYSTEM) or a dedicated service account.

• Scenario: Scheduled Phishing Simulation Campaigns

  • Context: Security teams utilize platforms like KnowBe4, Proofpoint Essentials, or SailPoint to conduct internal phishing simulations. These tools often host simulated landing pages containing URLs that structurally resemble the Mozi family’s known malicious domains (e.g., using similar TLDs or subdomain patterns) to test user behavior without actually deploying the real malware payload.
  • Filter/Exclusion: Implement a whitelist based on Source IP Range and URL Domain. Add the specific IP ranges of your internal security simulation platform (e.g., KnowBe4 CDN IPs) to an allow-list, or exclude URLs containing specific query parameters unique to the simulation tool (e.g., ?campaign_id=internal_test).

• Scenario: Third-Party Content Delivery Network (CDN) Caching

  • **Context