ThreatFox: Mozi IOCs

Hunt Hypothesis

Mozi is a prevalent Linux botnet often used for cryptomining and DDoS attacks, making the presence of its specific indicators of compromise a strong signal of a compromised host or container. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected workloads before the botnet can establish persistence, consume excessive resources, or participate in coordinated network attacks.

IOC Summary

Malware Family: Mozi Total IOCs: 3 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://203.99.56.137:36975/Mozi.m", "http://223.123.125.178:38438/Mozi.m", "http://202.47.44.156:53119/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

• Legacy Application Dependency on Mozi-Associated Binaries: Some older enterprise applications or third-party plugins (e.g., specific versions of Java-based middleware or legacy .NET apps) may bundle or invoke binaries that match the specific hash or path patterns of the Mozi IOCs.
  • Filter/Exclusion: Exclude known application directories such as C:\Program Files\LegacyApp\bin\ or specific service executable names like LegacyService.exe if confirmed to be signed by the vendor.
• Scheduled Maintenance Jobs Using Temp Files: Administrative scheduled tasks (e.g., PowerShell scripts run via Task Scheduler) that download or extract tools into C:\Windows\Temp or %TEMP% may create files with names or hashes that coincidentally match the Mozi IOCs, especially if the IOCs are based on generic filenames like svchost.exe or update.exe in temporary locations.
  • Filter/Exclusion: Exclude processes or files located in C:\Windows\Temp or %TEMP% if the parent process is TaskScheduler.exe or powershell.exe and the file age is less than 24 hours.
• Antivirus Quarantine or Staging Areas: Security products like CrowdStrike, SentinelOne, or Microsoft Defender may stage or quarantine suspicious files in specific directories (e.g., C:\ProgramData\McAfee\AVEngine\Quarantine or C:\ProgramData\CrowdStrike\quarantine). If the Mozi IOCs include file hashes, these quarantined copies may trigger the rule.
  • Filter/Exclusion: Exclude file paths containing keywords like Quarantine, Staging, or Temp within known security product directories (e.g., C:\ProgramData\CrowdStrike, C:\Program Files (x86)\Microsoft Security Client).