I'm trying to setup a VM that will try to mimick malicious web browsing behavior.
It sounds like you are trying to mimick web browsing of malicious sites, not malicious browsing of web sites.
It should download malware and just get infected.
As a precaution, you should run the VM on a system that is physically isolated from the rest of your network (for example, an old laptop). Ideally, tape over the webcam, and disconnect the microphone, BT, WiFi (though that may require opening it up). It should have wired Internet only with a firewall that prevents it from accessing the rest of your network, such as a so-called "DMZ" configuration.
There are a lot of open source threat intel feeds with bad IPs and URLs. Is there a way to have it visit malicious sites and get infected?
Shouldn't be too difficult to write a script that repeatedly opens firefox with a URL from a list and then kills firefox a few tens of seconds later after the malicious website has had time to do its thing.
In case you are wondering why, it's in a test lab and I'm trying to test how well my IDS and malware sandboxes work.
Great. Just be careful. Be very careful.