ThreatFox: Mozi IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets the Mozi botnet, a prevalent IoT malware family that often propagates via brute-force attacks on exposed services to establish persistent footholds in network perimeters. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised edge devices or servers before they are leveraged for DDoS amplification or lateral movement, mitigating the high severity risk associated with this widespread threat.

IOC Summary

Malware Family: Mozi Total IOCs: 6 IOC Types: url

Type	Value	Threat Type	First Seen	Confidence
url	`hxxp://139[.]135[.]60[.]100:51948/Mozi.m`	payload_delivery	2026-09-06	75%
url	`hxxp://103[.]82[.]120[.]123:54075/Mozi.m`	payload_delivery	2026-09-06	75%
url	`hxxp://139[.]135[.]46[.]180:54994/Mozi.m`	payload_delivery	2026-09-06	75%
url	`hxxp://223[.]123[.]49[.]139:48395/Mozi.m`	payload_delivery	2026-09-06	75%
url	`hxxp://27[.]222[.]48[.]192:43573/Mozi.a`	payload_delivery	2026-09-06	75%
url	`hxxp://137[.]59[.]229[.]65:46444/Mozi.m`	payload_delivery	2026-09-06	75%

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://139.135.60.100:51948/Mozi.m", "http://103.82.120.123:54075/Mozi.m", "http://139.135.46.180:54994/Mozi.m", "http://223.123.49.139:48395/Mozi.m", "http://27.222.48.192:43573/Mozi.a", "http://137.59.229.65:46444/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Mozi

False Positive Guidance

Scenario: A DevOps engineer uses curl to download a Mozi botnet sample from a public ThreatFox IOC URL for testing purposes in an isolated lab environment, triggering the URL or hash match.
- Filter/Exclusion: Exclude alerts where the source process is curl.exe or wget.exe and the destination path contains /tmp/, /var/tmp/, or /test/, or restrict the rule to exclude hosts tagged with Environment=Lab or IsolationGroup=Dev.
Scenario: An automated vulnerability scanner (e.g., Nessus or Qualys) performs a network sweep that includes connecting to known Mozi C2 IPs or ports to verify open services, generating connection alerts that match the IP IOCs.
- Filter/Exclusion: Exclude alerts where the source process is nessus-agent.exe, qualys-agent.exe, or scanner-service.exe, or exclude connections where the source port is ephemeral (>1024) and the destination port matches known Mozi C2 ports (e.g., 80, 443, 8080) only if the source host is in the VulnerabilityScanner security group.
Scenario: A backup or sync tool (e.g., Veeam, Commvault, or rsync) transfers a file that happens to have a SHA256 hash matching one of the Mozi file IOCs due to a rare collision or because the file is a compressed archive containing the sample, triggering the file hash match.
- Filter/Exclusion: Exclude alerts where the source process is veeam.exe, commvault.exe, or rsync.exe, or exclude file paths that reside within backup directories such as /backup/, /volumes/, or \\server\backups\.
Scenario: A