ThreatFox: Mozi IOCs

Hunt Hypothesis

This hunt targets the presence of Mozi botnet indicators, a prevalent Linux-based malware family that often establishes persistent backdoors to facilitate command-and-control communications and lateral movement. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised workloads before the botnet can fully propagate, exfiltrate data, or participate in distributed denial-of-service attacks.

IOC Summary

Malware Family: Mozi Total IOCs: 4 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://102.33.78.165:43065/Mozi.m", "http://124.29.226.80:56932/Mozi.m", "http://203.101.186.93:59346/Mozi.7", "http://72.255.15.203:45769/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

• Scenario: A DevOps engineer runs a containerized build pipeline using docker or kubectl to deploy a microservice that includes a lightweight health-check agent. The agent’s binary or process name (e.g., mozi-agent or a specific hash) matches one of the Mozi IOCs, triggering the alert during routine CI/CD execution.

  • Filter/Exclusion: Exclude alerts where the parent process is docker, containerd-shim, or kubectl, or where the execution path resides within standard CI/CD directories like /opt/jenkins/ or /usr/local/bin/.

• Scenario: An IT administrator performs a manual backup verification using a third-party backup utility (e.g., Veeam, Commvault, or Acronis) that spawns a temporary helper process. If this helper process shares a similar name or memory signature with the Mozi IOCs (e.g., a generic helper.exe or specific module load), it may be flagged as suspicious.

  • Filter/Exclusion: Exclude alerts where the parent process is a known backup agent (e.g., VeeamBackup.exe, commvaultservice.exe) or where the process is executed from the vendor’s installation directory (e.g., C:\Program Files\Veeam\).

• Scenario: A security team conducts a periodic vulnerability scan using tools like Nessus, Qualys, or Tenable.io. These tools often spawn short-lived processes to probe services or validate configurations. If the scanner’s probe module or a specific plugin binary matches a Mozi IOC (particularly if the IOC is a generic hash or name), it triggers a false positive.

  • Filter/Exclusion: Exclude alerts where the parent process is a known scanner (e.g., nessus.exe, qualysagent.exe, tenableio.exe) or where the process is