This hypothesis targets the Mozi botnet, a prevalent IoT malware that often compromises unpatched devices to establish persistent command-and-control channels and participate in large-scale DDoS attacks. Proactively hunting for these specific IOCs in Azure Sentinel allows the SOC to identify compromised endpoints or network assets early, mitigating the risk of lateral movement and service disruption before the botnet can fully propagate or execute its payload.
Malware Family: Mozi Total IOCs: 3 IOC Types: url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxp://14[.]154[.]44[.]121:46114/Mozi.m | payload_delivery | 2026-09-27 | 75% |
| url | hxxp://223[.]123[.]47[.]239:47542/Mozi.a | payload_delivery | 2026-09-27 | 75% |
| url | hxxp://223[.]123[.]73[.]8:47295/Mozi.m | payload_delivery | 2026-09-27 | 75% |
// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://14.154.44.121:46114/Mozi.m", "http://223.123.47.239:47542/Mozi.a", "http://223.123.73.8:47295/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
UrlClickEvents | Ensure this data connector is enabled |
Automated Patch Management and Deployment: Enterprise patch management tools like WSUS (Windows Server Update Services) or Ansible often execute cmd.exe or powershell.exe to apply updates, reboot systems, or verify service states. These processes may spawn child processes or write temporary files that match Mozi IOCs (e.g., specific registry keys or file paths in C:\Windows\Temp or C:\ProgramData).
wuaex.exe, svchost.exe (specific to the Windows Update service), or python.exe (for Ansible), and where the command line contains keywords like /install, /update, or patch.Scheduled Backup and Cleanup Jobs: Scheduled tasks using Veeam, Commvault, or native Task Scheduler jobs that perform log rotation, temp file cleanup, or snapshot creation. These jobs frequently access or modify files in common Mozi drop locations (e.g., C:\Users\Public, C:\ProgramData) and may create short-lived processes that match the IOCs.
taskeng.exe or taskengw.exe, or where the command line includes backup-specific verbs like backup, snapshot, or cleanup.Endpoint Detection and Response (EDR) Agent Self-Tests: EDR agents like CrowdStrike Falcon, Carbon Black, or Defender for Endpoint perform periodic self-integrity checks or behavioral simulations. These tests may intentionally create benign processes or modify registry keys to validate detection logic, potentially triggering Mozi IOCs if the test mimics common malware behaviors.