ThreatFox: Mozi IOCs

Hunt Hypothesis

This hypothesis targets the presence of Mozi botnet indicators, a prevalent IoT malware family that often establishes persistent backdoors and facilitates distributed denial-of-service attacks. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised endpoints or network assets before they are leveraged to amplify traffic or exfiltrate data, thereby reducing the overall attack surface.

IOC Summary

Malware Family: Mozi Total IOCs: 3 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://115.55.144.250:57502/Mozi.7", "http://139.135.41.164:40894/Mozi.m", "http://72.255.26.37:45994/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

• Scenario: A network operations engineer runs a manual nmap scan or uses a tool like Masscan to audit internal subnet reachability, generating high-volume connection attempts that match Mozi’s lateral movement or scanning IOCs.

  • Filter/Exclusion: Exclude source IPs belonging to the NetOps-Scanning service account or specific jump hosts (e.g., jumphost-01.corp.local) when the destination port is in the standard service range (1-1024) and the connection state is SYN_SENT without subsequent ESTABLISHED traffic.

• Scenario: A DevOps team executes a scheduled cron job or Ansible playbook that performs routine health checks by pinging or TCP-connecting to a list of internal application servers, triggering IOC matches for known Mozi target ports or IP ranges.

  • Filter/Exclusion: Exclude events where the source process is ansible-playbook, python (with ansible in the command line), or cron (PID 1 or specific service PIDs) and the destination host is part of the App-Infra AD group.

• Scenario: A security team deploys a honeypot or canary token system that intentionally listens on common Mozi ports (e.g., 80, 443, 8080) to detect unauthorized access, causing legitimate internal services to connect to these ports and trigger false positives.

  • Filter/Exclusion: Exclude connections where the destination IP is registered in the Honeypot-IPs list or where the destination process is known canary software (e.g., canarytoken-agent, honeypot-server).

• Scenario: A legacy application server running an outdated Java or .NET framework initiates outbound connections to internal monitoring agents or