This hunt targets the Mozi botnet, a prevalent IoT malware strain that often propagates through unpatched devices to establish command-and-control channels and launch distributed denial-of-service attacks. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints or network traffic patterns early, mitigating the risk of lateral movement and service disruption before the botnet can fully propagate within the environment.
Malware Family: Mozi Total IOCs: 3 IOC Types: url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxp://223[.]123[.]73[.]173:35250/Mozi.a | payload_delivery | 2026-09-25 | 75% |
| url | hxxp://59[.]103[.]106[.]211:60515/Mozi.m | payload_delivery | 2026-09-25 | 75% |
| url | hxxp://124[.]29[.]194[.]194:43904/Mozi[.]7 | payload_delivery | 2026-09-25 | 75% |
// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://223.123.73.173:35250/Mozi.a", "http://59.103.106.211:60515/Mozi.m", "http://124.29.194.194:43904/Mozi.7"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
UrlClickEvents | Ensure this data connector is enabled |
Scenario: A network operations center (NOC) engineer uses Wireshark or tcpdump to capture traffic on a production switch port to troubleshoot latency issues, inadvertently capturing Mozi-related beaconing traffic from a compromised endpoint that is still active but not yet isolated.
10.20.50.0/24) or where the process name is wireshark, tshark, or tcpdump.Scenario: A DevOps team runs a Jenkins pipeline that includes a security scanning stage using ClamAV or YARA rules to validate container images before deployment, which scans for known Mozi IOCs (such as specific file hashes or registry keys) as part of a CI/CD gate.
java (Jenkins runtime) and the command line contains clamscan or yara.Scenario: An IT administrator performs a manual System Restore or uses Windows Recovery Environment (WinRE) to revert a test VM to a previous checkpoint, which temporarily re-exposes Mozi-related artifacts (like specific registry keys or file paths) that were present in the snapshot before the malware was fully cleaned.
environment=dev or vm=true and the event timestamp aligns with a scheduled maintenance window or a recent vssadmin or wbadmin execution.Scenario: A security engineer uses Sysinternals Process Monitor (ProcMon) to audit a newly deployed application for unexpected file system or registry access, and the