ThreatFox: Mozi IOCs

Hunt Hypothesis

This hunt targets the Mozi botnet, a prevalent Linux-based malware family that establishes persistent backdoor access and facilitates command-and-control communication through known IP addresses and file paths. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised virtual machines or containers before the botnet can be leveraged for DDoS attacks or lateral movement within the cloud infrastructure.

IOC Summary

Malware Family: Mozi Total IOCs: 8 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://223.123.43.33:45481/Mozi.m", "http://27.77.246.66:44109/Mozi.m", "http://221.15.20.208:44679/Mozi.m", "http://223.123.71.42:37337/Mozi.m", "http://153.117.9.176:46305/Mozi.m", "http://160.30.142.218:44307/Mozi.m", "http://137.59.218.242:50617/Mozi.m", "http://119.30.117.159:46505/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

• Legacy IoT/OT Device Firmware Updates: Industrial controllers or older network appliances (e.g., Siemens PLCs, Cisco IOS routers) running outdated firmware may contain hardcoded strings or default configurations that match Mozi IOCs (such as specific user-agent strings or known bad hash values).
  • Filter/Exclusion: Exclude processes originating from known OT/IoT management tools like Kepware, Ignition, or Cisco Prime and limit the scope to servers with OS versions older than Windows Server 2012 or Linux kernels < 4.0.
• Third-Party Backup & Restore Operations: Enterprise backup solutions like Veeam, Commvault, or Rubrik often create temporary shadow copies or staging files in specific directories (e.g., C:\ProgramData\BackupStaging). If the backup agent writes a file with a name or hash matching a Mozi IOC, it can trigger the rule.
  • Filter/Exclusion: Exclude events where the parent process is VeeamBackup.exe, cvpp.exe (Commvault), or rubik-agent.exe, and restrict the file path to standard backup staging directories like C:\ProgramData\Veeam\ or D:\BackupStaging\.
• Software Development & CI/CD Build Agents: Continuous Integration servers (e.g., Jenkins, GitHub Actions, Azure DevOps) frequently download and execute build artifacts, test binaries, or dependency packages that may include test fixtures or mock libraries containing Mozi-related strings or hashes for unit testing.
  • Filter/Exclusion: Exclude processes running under service accounts like jenkins-svc, ci-runner, or build-agent, and limit the file path to workspace directories such as C:\Jenkins\workspace\ or /home/runner/work/.
• **Legacy Application Patch