Mozi is a prevalent IoT botnet that leverages UDP scanning and specific command-and-control channels to propagate across vulnerable devices, making it a critical threat for environments with exposed internet-facing assets. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised endpoints or network traffic patterns before the botnet can execute large-scale DDoS attacks or establish persistent footholds within the infrastructure.
Malware Family: Mozi Total IOCs: 5 IOC Types: url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxp://203[.]128[.]24[.]233:35988/Mozi[.]7 | payload_delivery | 2026-09-26 | 75% |
| url | hxxp://111[.]92[.]157[.]232:33256/Mozi.a | payload_delivery | 2026-09-26 | 75% |
| url | hxxp://223[.]123[.]124[.]122:43470/Mozi[.]7 | payload_delivery | 2026-09-26 | 75% |
| url | hxxp://153[.]117[.]41[.]26:53067/Mozi.m | payload_delivery | 2026-09-26 | 75% |
| url | hxxp://103[.]213[.]112[.]230:47451/Mozi.m | payload_delivery | 2026-09-26 | 75% |
// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://203.128.24.233:35988/Mozi.7", "http://111.92.157.232:33256/Mozi.a", "http://223.123.124.122:43470/Mozi.7", "http://153.117.41.26:53067/Mozi.m", "http://103.213.112.230:47451/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
UrlClickEvents | Ensure this data connector is enabled |
curl or wget to download a specific Mozi binary hash from a trusted internal artifact repository (e.g., Artifactory or Nexus) for testing or deployment, triggering the hash-based IOC.
10.20.0.0/16) AND the destination port is 443 (HTTPS) or 80 (HTTP), ensuring the download originates from a known internal repository rather than an external threat actor.\test\ or \lab\ in the directory structure, or where the parent process is powershell.exe initiated by a scheduled task named Mozi_Detection_Test, indicating a controlled validation exercise.C:\Program Files\MyApp\lib\ or /usr/local/lib/myapp/) and the file extension is .dll or .so, provided the file was created by a known application installer process (e.g., msiexec.exe or setup.exe) rather than a web server or browser.