URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving the Mozi malware family by flagging network traffic to known malicious URLs that facilitate command-and-control communications or payload delivery. Proactive hunting in Azure Sentinel is critical because Mozi’s sophisticated evasion techniques often bypass standard signature-based defenses, requiring behavioral analysis of these specific URL patterns to prevent early-stage infection and lateral movement within the environment.

IOC Summary

Threat: Mozi Total URLs: 4 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["115.62.133.38", "27.207.186.54", "188.19.145.228", "123.4.232.69"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["115.62.133.38", "27.207.186.54", "188.19.145.228", "123.4.232.69"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 3-5 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Security Team Manual Threat Hunting via URLhaus API

  • Context: The internal threat intelligence team runs a daily scheduled job using Python scripts (requests library) or PowerShell to query the urlhaus-api endpoint directly. These queries often hit known Mozi-tagged URLs that are currently being analyzed in the sandbox, triggering the alert even though the access is authorized and expected.
  • Suggested Filter/Exclusion: Create a detection exclusion based on the source IP range of the Security Operations Center (SOC) jump hosts or the specific service account used by the threat hunting script (e.g., src_ip: 10.20.5.0/24 OR user_agent:*ThreatHuntService*).

• Scenario: Automated Browser Extension Updates

  • Context: Enterprise-managed browsers like Microsoft Edge or Google Chrome, configured with the Enterprise Policy to auto-update extensions, frequently download update manifests from Mozi-tagged domains. These downloads occur during off-hours via a scheduled task (UpdateExtension) and are legitimate maintenance activities that mimic malicious URL access patterns.
  • Suggested Filter/Exclusion: Exclude traffic originating from the specific browser process ID or application name (e.g., process_name: msedge.exe OR app_name: Google Chrome) where the destination URL contains a known update path pattern, such as /update/manifest.json or /extension/update.

• Scenario: Third-Party Cloud Backup Synchronization

  • Context: The organization utilizes Veeam Backup & Replication or Rubrik, which performs nightly synchronization jobs. These tools occasionally reach out