This rule detects the presence of known Mozi botnet indicators, which are frequently used by adversaries to establish persistent command-and-control channels and execute remote code execution on compromised hosts. Proactively hunting for these IOCs in Azure Sentinel is critical because Mozi is a prevalent threat in IoT and server environments, allowing the SOC to identify and isolate infected assets before they are leveraged for lateral movement or data exfiltration.
Malware Family: Mozi Total IOCs: 7 IOC Types: url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxp://223[.]123[.]35[.]122:44628/Mozi.m | payload_delivery | 2026-09-04 | 75% |
| url | hxxp://115[.]57[.]204[.]186:60274/Mozi.m | payload_delivery | 2026-09-04 | 75% |
| url | hxxp://105[.]198[.]0[.]3:37775/Mozi.m | payload_delivery | 2026-09-04 | 75% |
| url | hxxp://139[.]135[.]59[.]203:59228/Mozi[.]7 | payload_delivery | 2026-09-04 | 75% |
| url | hxxp://113[.]255[.]196[.]148:47674/Mozi.m | payload_delivery | 2026-09-04 | 75% |
| url | hxxp://190[.]196[.]253[.]116:11818/Mozi.m | payload_delivery | 2026-09-04 | 75% |
| url | hxxp://72[.]255[.]33[.]66:58752/Mozi.a | payload_delivery | 2026-09-04 | 75% |
// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://223.123.35.122:44628/Mozi.m", "http://115.57.204.186:60274/Mozi.m", "http://105.198.0.3:37775/Mozi.m", "http://139.135.59.203:59228/Mozi.7", "http://113.255.196.148:47674/Mozi.m", "http://190.196.253.116:11818/Mozi.m", "http://72.255.33.66:58752/Mozi.a"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
UrlClickEvents | Ensure this data connector is enabled |
Legitimate Use of netstat/ss in Monitoring Scripts: Many enterprise monitoring agents (e.g., Datadog, New Relic, or custom Bash scripts) frequently execute netstat -an or ss -tlnp to audit open ports and connections. If the Mozi IOCs include specific hash values or command-line patterns that overlap with standard network utility invocations, these routine checks can trigger alerts.
datadog-agent.exe, newrelic-agent) or where the command line matches netstat -an or ss -tlnp without additional suspicious arguments.Scheduled Backup Jobs Using rsync or robocopy: Mozi often uses file transfer mechanisms. In enterprise environments, scheduled tasks (via Windows Task Scheduler or Cron) frequently run robocopy or rsync to move data between servers. If the IOCs target specific file paths or transfer commands, these legitimate backup operations can be flagged.
robocopy.exe or rsync and the parent process is svchost.exe (indicating a service) or cron/crond, and the destination path is within known backup directories (e.g., \\backup-server\share, /var/backups/).Development Environments Running Docker/Kubernetes: In DevOps environments, docker or kubectl commands often involve pulling images, inspecting containers, or executing commands within pods. If the Mozi IOCs include generic container runtime commands or specific image hashes that coincide with internal registry images, these can cause false positives.