This hypothesis targets the presence of known Mozi botnet indicators, which are frequently used to establish persistent backdoors and facilitate command-and-control channels for ransomware deployment. Proactively hunting for these IOCs in Azure Sentinel is critical because Mozi often serves as an initial access vector for high-impact attacks, allowing the SOC to identify compromised assets before they are leveraged for lateral movement or data exfiltration.
Malware Family: Mozi Total IOCs: 4 IOC Types: url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxp://72[.]255[.]26[.]49:39564/Mozi.m | payload_delivery | 2026-09-02 | 75% |
| url | hxxp://72[.]255[.]15[.]152:50287/Mozi.m | payload_delivery | 2026-09-02 | 75% |
| url | hxxp://103[.]18[.]14[.]56:59567/Mozi.m | payload_delivery | 2026-09-02 | 75% |
| url | hxxp://72[.]255[.]37[.]113:54826/Mozi.m | payload_delivery | 2026-09-02 | 75% |
// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://72.255.26.49:39564/Mozi.m", "http://72.255.15.152:50287/Mozi.m", "http://103.18.14.56:59567/Mozi.m", "http://72.255.37.113:54826/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
UrlClickEvents | Ensure this data connector is enabled |
Automated Patch Management and Deployment: Enterprise patching tools like WSUS (Windows Server Update Services) or SCCM (System Center Configuration Manager) often execute wusa.exe or msiexec.exe from specific administrative shares or local paths that may match the file path or hash IOCs associated with Mozi.
wuaexer.exe, ccmexec.exe, or svchost.exe (specifically the Windows Update service) and the command line contains standard update parameters like /quiet or /norestart.Legacy Application Installation via Scheduled Tasks: Administrators frequently use Task Scheduler to deploy or update legacy line-of-business applications (e.g., old Java-based tools or custom internal utilities) during off-hours. These tasks may install executables to C:\Program Files\ or C:\Users\Public\ that inadvertently match the directory structure or binary name IOCs.
schtasks.exe or taskschd.msi and the working directory is a known application folder (e.g., C:\Program Files\InternalApp\) rather than a generic temp or public directory.Third-Party Antivirus or EDR Self-Updates: Security tools like CrowdStrike Falcon, Carbon Black, or Trend Micro perform self-updates or component installations that may write files to C:\ProgramData\ or C:\Windows\Temp\ with names or paths that overlap with Mozi IOCs (especially if the IOC is based on generic temp file patterns or specific DLL names).