ThreatFox: Mozi IOCs

Hunt Hypothesis

This hypothesis targets the presence of Mozi botnet indicators, which are frequently used to establish persistent backdoors and facilitate command-and-control communications within compromised Azure environments. Proactively hunting for these specific IOCs allows the SOC team to identify stealthy, low-and-slow intrusions before they escalate into lateral movement or data exfiltration events.

IOC Summary

Malware Family: Mozi Total IOCs: 4 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://111.184.208.168:54288/Mozi.m", "http://105.184.7.6:49853/Mozi.m", "http://42.7.119.110:43491/Mozi.m", "http://190.196.253.126:11853/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

• Scenario: A DevOps engineer uses ansible or puppet to deploy configuration files to a fleet of Linux servers, where the payload includes base64-encoded strings that match one of the Mozi IOCs (e.g., specific hash or string pattern) due to a shared library or dependency.
  • Filter/Exclusion: Exclude alerts where the process is a known configuration management agent (e.g., ansible-playbook, puppet-agent, chef-client) and the parent process is a service manager or cron job, provided the user is in the devops or automation group.
• Scenario: A security team runs a YARA scan or uses clamav/malwarebytes to scan backup archives or ISO images stored in a network share, and the scanner’s internal engine or the scanned content contains a string matching a Mozi IOC (e.g., a known sample hash or URL fragment).
  • Filter/Exclusion: Exclude alerts originating from processes like clamscan, mbam, yara, or virusd when the file path resides in designated backup or archive directories (e.g., /backups/, /archives/, \\fileserver\backups\).
• Scenario: A CI/CD pipeline (e.g., Jenkins, GitLab CI) executes a build step that downloads a third-party binary or library from a public repository, which happens to contain a string or hash matching a Mozi IOC due to a common dependency or embedded metadata.
  • Filter/Exclusion: Exclude alerts where the parent process is a CI/CD agent (e.g., jenkins-agent, gitlab-runner, drone) and the working directory is within the standard workspace path (e.g., /var/lib/jenkins/workspace/, /home/gitlab-runner/builds/).