This hunt targets the presence of known Mozi botnet URLs in network traffic or web proxy logs to identify hosts that have been compromised by this prevalent IoT and enterprise malware. Proactively hunting for these specific indicators allows the SOC to detect lateral movement or command-and-control activity before the botnet can fully establish its foothold and propagate across the Azure environment.
Threat: Mozi Total URLs: 29 Active URLs: 29
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://222.140.181.143:59511/i | online | malware_download | 2026-09-18 |
hxxp://186.149.204.12:44092/bin.sh | online | malware_download | 2026-09-18 |
hxxp://182.116.37.55:48418/i | online | malware_download | 2026-09-18 |
hxxp://27.202.213.104:47161/i | online | malware_download | 2026-09-18 |
hxxp://27.202.213.104:47161/bin.sh | online | malware_download | 2026-09-18 |
hxxp://182.127.28.232:46971/i | online | malware_download | 2026-09-18 |
hxxp://182.126.86.37:36430/bin.sh | online | malware_download | 2026-09-18 |
hxxp://182.116.51.230:38010/bin.sh | online | malware_download | 2026-09-18 |
hxxp://221.14.37.243:47221/i | online | malware_download | 2026-09-18 |
hxxp://159.196.55.40:52215/i | online | malware_download | 2026-09-18 |
hxxp://182.126.86.37:36430/i | online | malware_download | 2026-09-18 |
hxxp://42.224.28.149:34525/i | online | malware_download | 2026-09-18 |
hxxp://219.157.186.104:55676/i | online | malware_download | 2026-09-18 |
hxxp://219.157.186.104:55676/bin.sh | online | malware_download | 2026-09-18 |
hxxp://221.14.37.243:47221/bin.sh | online | malware_download | 2026-09-18 |
hxxp://182.121.9.253:59649/i | online | malware_download | 2026-09-18 |
hxxp://85.219.201.2:42660/i | online | malware_download | 2026-09-18 |
hxxp://219.157.7.128:34448/i | online | malware_download | 2026-09-18 |
hxxp://42.224.188.114:52819/i | online | malware_download | 2026-09-18 |
hxxp://42.239.12.252:36146/bin.sh | online | malware_download | 2026-09-18 |
hxxp://222.138.214.222:52414/i | online | malware_download | 2026-09-18 |
hxxp://61.163.149.2:47861/i | online | malware_download | 2026-09-18 |
hxxp://42.239.12.252:36146/i | online | malware_download | 2026-09-18 |
hxxp://182.121.9.253:59649/bin.sh | online | malware_download | 2026-09-18 |
hxxp://42.224.196.233:55298/bin.sh | online | malware_download | 2026-09-18 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["221.0.56.130", "27.202.213.104", "59.103.116.83", "182.116.51.230", "219.157.186.104", "42.239.238.31", "61.163.149.2", "182.121.9.253", "182.127.28.232", "221.14.37.243", "42.224.28.149", "182.116.37.55", "186.149.204.12", "222.140.181.143", "42.224.196.233", "42.224.188.114", "42.239.12.252", "219.157.7.128", "27.215.124.221", "159.196.55.40", "222.138.214.222", "182.126.86.37", "85.219.201.2"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["221.0.56.130", "27.202.213.104", "59.103.116.83", "182.116.51.230", "219.157.186.104", "42.239.238.31", "61.163.149.2", "182.121.9.253", "182.127.28.232", "221.14.37.243", "42.224.28.149", "182.116.37.55", "186.149.204.12", "222.140.181.143", "42.224.196.233", "42.224.188.114", "42.239.12.252", "219.157.7.128", "27.215.124.221", "159.196.55.40", "222.138.214.222", "182.126.86.37", "85.219.201.2"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
10.20.5.0/24) or filter by User-Agent strings containing Java/1.8 or Apache-HttpClient if the Mozi URL is accessed via HTTP GET without POST data.ci-runner) or filter by the specific path suffix of the URL if it matches a known artifact pattern (e.g., /lib/, /pkg/).powershell.exe or bash originating from backup servers, or filter by the specific scheduled task name (e.g., BackupVerify) if the detection rule can correlate with process context.