This hunt detects adversary behavior where threat actors leverage Mozi-tagged malicious URLs to distribute malware and establish initial footholds within the network. The SOC team should proactively search for these indicators in Azure Sentinel to identify early-stage compromise vectors before they propagate across endpoints or exfiltrate sensitive data.
Threat: Mozi Total URLs: 43 Active URLs: 43
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://39.78.26.151:57370/bin.sh | online | malware_download | 2026-08-17 |
hxxp://115.56.66.143:59123/bin.sh | online | malware_download | 2026-08-17 |
hxxp://222.140.159.233:46480/bin.sh | online | malware_download | 2026-08-17 |
hxxp://182.121.66.162:41960/i | online | malware_download | 2026-08-17 |
hxxp://121.231.77.43:2715/i | online | malware_download | 2026-08-17 |
hxxp://125.42.255.46:55570/bin.sh | online | malware_download | 2026-08-17 |
hxxp://123.9.41.95:38149/i | online | malware_download | 2026-08-17 |
hxxp://115.48.146.252:57987/bin.sh | online | malware_download | 2026-08-17 |
hxxp://61.53.110.220:49686/bin.sh | online | malware_download | 2026-08-17 |
hxxp://125.44.53.155:43350/i | online | malware_download | 2026-08-17 |
hxxp://123.11.204.30:46437/i | online | malware_download | 2026-08-17 |
hxxp://61.52.159.43:42655/i | online | malware_download | 2026-08-17 |
hxxp://46.236.65.163:51558/bin.sh | online | malware_download | 2026-08-17 |
hxxp://123.13.80.50:56227/bin.sh | online | malware_download | 2026-08-17 |
hxxp://182.118.241.162:42966/i | online | malware_download | 2026-08-17 |
hxxp://61.53.110.220:49686/i | online | malware_download | 2026-08-17 |
hxxp://61.53.74.117:55662/i | online | malware_download | 2026-08-17 |
hxxp://219.156.20.248:59087/i | online | malware_download | 2026-08-17 |
hxxp://182.118.246.94:39103/bin.sh | online | malware_download | 2026-08-17 |
hxxp://123.11.78.154:48079/i | online | malware_download | 2026-08-17 |
hxxp://123.13.80.50:56227/i | online | malware_download | 2026-08-17 |
hxxp://115.57.30.45:34814/i | online | malware_download | 2026-08-17 |
hxxp://115.63.145.245:55982/i | online | malware_download | 2026-08-17 |
hxxp://125.41.227.14:47543/i | online | malware_download | 2026-08-17 |
hxxp://182.121.244.13:44914/i | online | malware_download | 2026-08-17 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["39.78.26.151", "182.116.34.137", "219.157.34.223", "115.63.145.245", "123.9.41.95", "182.118.246.94", "125.41.227.14", "182.121.244.13", "46.236.65.163", "61.52.159.43", "125.42.255.46", "182.121.66.162", "61.53.119.47", "115.48.146.252", "115.57.30.45", "125.44.53.155", "61.53.110.220", "182.118.241.162", "61.53.74.117", "123.13.80.50", "115.56.66.143", "123.11.78.154", "123.11.204.30", "121.231.77.43", "222.140.159.233", "110.38.207.151", "219.156.20.248"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["39.78.26.151", "182.116.34.137", "219.157.34.223", "115.63.145.245", "123.9.41.95", "182.118.246.94", "125.41.227.14", "182.121.244.13", "46.236.65.163", "61.52.159.43", "125.42.255.46", "182.121.66.162", "61.53.119.47", "115.48.146.252", "115.57.30.45", "125.44.53.155", "61.53.110.220", "182.118.241.162", "61.53.74.117", "123.13.80.50", "115.56.66.143", "123.11.78.154", "123.11.204.30", "121.231.77.43", "222.140.159.233", "110.38.207.151", "219.156.20.248"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, along with targeted filters and exclusions:
Scenario: Automated Threat Intelligence Feed Synchronization
Source_IP = 10.20.5.15 AND Process_Name = "feed_sync_service.exe").Scenario: Endpoint Antivirus Definition Updates
User_Account = "svc-antivirus-update") or filter based on the process name of the update agent (e.g., Process_Name = "DefenderSvc.exe").Scenario: Security Research and Sandbox Analysis