ThreatFox: Mozi IOCs

Hunt Hypothesis

This detection rule identifies Mozi backdoor activity by monitoring for indicators of remote command execution and data exfiltration driven by phishing or compromised web delivery vectors. Proactive hunting in Azure Sentinel is critical to uncover persistent access and lateral movement behaviors that may evade standard perimeter defenses through encrypted C2 communications.

IOC Summary

Malware Family: Mozi Total IOCs: 4 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://59.97.250.11:43040/Mozi.m", "http://91.234.62.215:57642/Mozi.m", "http://202.163.68.10:47266/Mozi.m", "http://153.117.40.227:53474/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Mozi IOCs detection rule, tailored for a legitimate enterprise environment:

• Scenario: Legitimate Cloud Backup Synchronization

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault, or Acronis) often establish persistent outbound connections to cloud storage endpoints. These agents frequently use encrypted channels and execute remote commands to manage data exfiltration schedules, mimicking Mozi’s C2 behavior.
  • Filter/Exclusion: Exclude traffic originating from the specific service accounts (e.g., svc-backup-agent) running on known backup server IPs where the destination FQDN matches approved cloud storage domains (e.g., *.aws.amazon.com, *.azure.com).

• Scenario: Scheduled Software Update Deployment

  • Context: Automated deployment tools like Microsoft Endpoint Configuration Manager (SCCM) or Ivanti launch scheduled jobs to push updates and execute remote scripts. These processes generate high-volume outbound traffic with encrypted payloads that can resemble the exploit kit delivery and lateral movement patterns of Mozi.
  • Filter/Exclusion: Create a rule exclusion for processes named ccmsetup.exe or Ivanti.Agent.exe running during defined maintenance windows (e.g., 02:00–04:00 UTC), specifically filtering out connections to known vendor update repositories.

• Scenario: Third-Party CRM Data Integration

  • Context: Business applications such as Salesforce or HubSpot utilize background services to sync customer data and execute webhooks. These integrations often involve downloading payloads from external URLs and establishing encrypted command channels, which can trigger the “malicious download” and “data exfiltration” logic of the Mozi rule.
  • Filter/Exclusion: Whitelist outbound traffic from specific application servers (e.g.,