ThreatFox: Mozi IOCs

Hunt Hypothesis

This hunt targets the presence of known Mozi botnet indicators, which are frequently used to establish persistent backdoors and enable remote command-and-control over compromised systems. Proactively hunting for these IOCs in Azure Sentinel is critical because Mozi is a high-severity threat that often operates stealthily to facilitate lateral movement and data exfiltration, allowing the SOC to detect and isolate infected assets before they are leveraged for broader network compromise.

IOC Summary

Malware Family: Mozi Total IOCs: 4 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://72.255.26.34:51571/Mozi.a", "http://103.65.30.159:46727/Mozi.m", "http://223.123.43.252:57243/Mozi.m", "http://139.135.43.129:35781/Mozi.a"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

• Scenario: A DevOps team uses a CI/CD pipeline (e.g., Jenkins or GitLab CI) to deploy a lightweight monitoring agent or log collector that shares the same binary hash or file path as a known Mozi variant.

  • Filter/Exclusion: Exclude alerts where the parent process is a known build/CI tool (e.g., java.exe for Jenkins, node.exe for GitLab Runner) or where the file path resides within a dedicated CI/CD workspace directory (e.g., C:\Jenkins\workspace\, C:\gitlab-runner\builds\).

• Scenario: An IT administrator manually downloads a specific version of a third-party utility (e.g., a portable version of WinSCP or a network diagnostic tool) that has a known collision with a Mozi IOC hash due to outdated vendor builds or shared code libraries.

  • Filter/Exclusion: Exclude alerts if the file’s digital signature is valid and matches a trusted vendor (e.g., winscp.com, tinfoil.io), or if the file was downloaded from an approved internal repository URL (e.g., https://repo.internal.corp/tools/) rather than an external public IP.

• Scenario: A scheduled task (e.g., Task Scheduler job named “NightlyBackup”) executes a script that copies or moves a backup archive to a network share, and the archive’s temporary staging file temporarily matches a Mozi IOC due to compression artifacts or shared library inclusion.

  • Filter/Exclusion: Exclude alerts if the parent process is schtasks.exe or Task Scheduler service (svchost.exe with SchedSvc), and the file path contains keywords like \backup\, \archive\, or \temp\staging\ and is located on a non-system drive (e.g., `D