ThreatFox: Mozi IOCs

Hunt Hypothesis

This hunt targets the Mozi botnet, a prevalent Linux-based malware family that establishes persistent command-and-control channels to execute remote code and propagate across IoT and server assets. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised endpoints early, preventing the botnet from leveraging the environment for DDoS attacks or lateral movement before it matures.

IOC Summary

Malware Family: Mozi Total IOCs: 4 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://59.103.100.133:39551/Mozi.m", "http://72.255.15.106:39182/Mozi.m", "http://223.123.35.124:38615/Mozi.m", "http://103.26.86.248:53078/Mozi.a"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

• Scenario: A legacy IoT device or industrial control system (ICS) gateway running an outdated firmware version that uses default or known Mozi-related network ports (e.g., 4444, 4445) for telemetry or control channels.

  • Filter/Exclusion: Exclude hosts tagged with IoT, ICS, or Legacy_Firmware in your asset inventory, or specifically exclude known MAC addresses/IP ranges associated with these devices from the Mozi IOC hunt.

• Scenario: A developer or DevOps engineer running a local test instance of a Mozi-based botnet framework or a specific malware sample in a sandboxed environment (e.g., using tools like anybox, docker, or vagrant) for analysis or regression testing.

  • Filter/Exclusion: Exclude hosts or containers labeled with Sandbox, Test_Lab, or Dev_Sandbox in your CMDB or cloud tagging system, and ensure these environments are isolated from production network segments.

• Scenario: A scheduled backup or log rotation job (e.g., using rsync, cron, or Windows Task Scheduler) that temporarily opens high-numbered ports or creates specific file artifacts that match one of the Mozi IOCs (such as a specific mutex name or registry key) due to a naming convention overlap or temporary state.

  • Filter/Exclusion: Correlate the alert with process parent-child relationships; exclude alerts where the parent process is a known service like svchost.exe, cron, or taskeng.exe, and verify the file path is within standard backup directories (e.g., /var/backups, C:\Backups).

• Scenario: A third-party monitoring agent (e.g., Datadog, New Relic, or Splunk Universal Forwarder) that uses a shared library or configuration