This hypothesis targets the presence of Mozi botnet indicators, which are frequently used for initial access and command-and-control operations to establish persistent footholds in compromised environments. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify and isolate infected assets early, mitigating the risk of lateral movement and data exfiltration before the adversary can fully leverage the botnet for larger-scale attacks.
Malware Family: Mozi Total IOCs: 6 IOC Types: url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxp://175[.]107[.]215[.]177:52035/Mozi.a | payload_delivery | 2026-09-12 | 75% |
| url | hxxp://153[.]117[.]13[.]231:52661/Mozi.m | payload_delivery | 2026-09-12 | 75% |
| url | hxxp://153[.]117[.]27[.]129:39542/Mozi.m | payload_delivery | 2026-09-12 | 75% |
| url | hxxp://111[.]92[.]157[.]228:57767/Mozi.m | payload_delivery | 2026-09-12 | 75% |
| url | hxxp://153[.]117[.]32[.]90:43505/Mozi.m | payload_delivery | 2026-09-12 | 75% |
| url | hxxp://42[.]237[.]35[.]35:60213/Mozi.m | payload_delivery | 2026-09-12 | 75% |
// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://175.107.215.177:52035/Mozi.a", "http://153.117.13.231:52661/Mozi.m", "http://153.117.27.129:39542/Mozi.m", "http://111.92.157.228:57767/Mozi.m", "http://153.117.32.90:43505/Mozi.m", "http://42.237.35.35:60213/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
UrlClickEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses Ansible or Terraform to provision a new Linux CI/CD worker node, where the initialization script downloads and executes a standard mozi-named utility (e.g., a custom internal tool or a misnamed binary) to configure network interfaces.
ansible-playbook, terraform, or cloud-init and the working directory is within /usr/local/bin or /opt/ansible/roles/.Scenario: A system administrator runs a scheduled cron job on a legacy application server to perform log rotation, invoking a custom script named mozi.sh (an acronym for “Monthly Operations Zero-hour Incident”) that archives logs to a NAS share.
logrotate, tar, or rsync and the user is root or appadmin on hosts tagged with environment=production and os=linux.Scenario: A QA team executes a Jenkins pipeline stage that runs a custom Python test harness named mozi_test.py to validate API endpoints against a staging environment, which temporarily binds to a local port and makes outbound HTTP requests.
java (Jenkins agent) or python3, and the destination IP is within the internal 10.0.0.0/8 range or matches the staging subnet CIDR.Scenario: An IT support technician uses RDP to connect to a Windows server and runs a PowerShell one-liner to check disk space, inadvertently using a variable name $mozi in the script (e.g., `$mozi = Get-Volume |