This hypothesis targets the presence of known Mozi botnet indicators, which are frequently used to establish persistent footholds and facilitate lateral movement or command-and-control communications within compromised environments. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected assets early, mitigating the risk of automated exploitation and data exfiltration before the botnet can scale its impact.
Malware Family: Mozi Total IOCs: 6 IOC Types: url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxp://178[.]160[.]10[.]203:35090/Mozi.m | payload_delivery | 2026-09-21 | 75% |
| url | hxxp://72[.]255[.]19[.]51:42035/Mozi.a | payload_delivery | 2026-09-21 | 75% |
| url | hxxp://111[.]92[.]157[.]231:51296/Mozi.m | payload_delivery | 2026-09-21 | 75% |
| url | hxxp://36[.]255[.]33[.]132:48916/Mozi.m | payload_delivery | 2026-09-21 | 75% |
| url | hxxp://103[.]104[.]215[.]10:57760/Mozi.m | payload_delivery | 2026-09-21 | 75% |
| url | hxxp://153[.]117[.]1[.]177:54794/Mozi.m | payload_delivery | 2026-09-21 | 75% |
// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://178.160.10.203:35090/Mozi.m", "http://72.255.19.51:42035/Mozi.a", "http://111.92.157.231:51296/Mozi.m", "http://36.255.33.132:48916/Mozi.m", "http://103.104.215.10:57760/Mozi.m", "http://153.117.1.177:54794/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
UrlClickEvents | Ensure this data connector is enabled |
curl or wget to download a specific Mozi binary variant (e.g., mozi.exe) from a trusted internal artifact repository or GitHub release page for testing or deployment.
curl.exe, wget.exe, powershell.exe with specific arguments).Environment: Lab or Role: Test in the asset inventory, or exclude processes running from a specific directory path (e.g., C:\Lab\MoziSamples\).mozi.exe or similar IOCs from a production server to a backup share or staging area, triggering file-based IOCs.
VeeamBackupService.exe, rsync.exe, robocopy.exe) or where the destination path matches a backup share pattern (e.g., \\backup-server\mozi\).