ThreatFox: Mozi IOCs

Hunt Hypothesis

This hypothesis targets the presence of Mozi botnet indicators, a prevalent Linux-based malware family known for establishing persistent backdoors and facilitating distributed denial-of-service attacks. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints early, preventing lateral movement and ensuring rapid containment before the botnet can be leveraged for large-scale attacks.

IOC Summary

Malware Family: Mozi Total IOCs: 2 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://190.196.253.43:11724/Mozi.m", "http://103.26.83.108:55431/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

• Scenario: Automated Patch Management and Cleanup

  • Context: Enterprise patch management tools (e.g., SCCM, Ansible, or custom PowerShell scripts) often download binary payloads or configuration files from external repositories to deploy updates. If the Mozi IOCs include specific file hashes or URLs, a legitimate patch package or a temporary staging directory created by the deployment agent could match the IOC if the hash is reused in a different context or if the URL is part of a CDN.
  • Filter/Exclusion: Exclude processes originating from known patch management service accounts (e.g., SCCMClient, AnsibleService) or exclude file paths under standard staging directories like C:\Windows\CCM\ or C:\ProgramData\Ansible\. Additionally, whitelist specific executable names used by the patching tool (e.g., ccmsetup.exe, ansible-playbook).

• Scenario: Developer Build Artifacts and CI/CD Pipelines

  • Context: Continuous Integration/Continuous Deployment (CI/CD) systems (e.g., Jenkins, GitLab CI, Azure DevOps) frequently download build artifacts, dependencies, or container images from external registries. If the Mozi IOCs include generic file names (e.g., update.exe, install.bin) or specific SHA256 hashes that happen to match a legitimate build artifact or a dependency library, the rule will trigger.
  • Filter/Exclusion: Exclude processes running under CI/CD service accounts (e.g., jenkins, gitlab-runner, vstsagent) or exclude file paths within workspace directories (e.g., C:\Jenkins\workspace\, C:\gitlab-runner\builds\). Whitelist known build tools like msbuild.exe, dotnet.exe, or java.exe when they are the parent process.