ThreatFox: Mozi IOCs

Hunt Hypothesis

This detection identifies adversary activity by matching network and endpoint telemetry against nine specific Indicators of Compromise (IOCs) linked to the Mozi threat actor, enabling the identification of potential early-stage intrusions or lateral movement. A proactive hunt is essential in Azure Sentinel because Mozi’s sophisticated tradecraft often involves stealthy initial access that may evade standard automated alerts, requiring manual correlation to prevent undetected persistence and data exfiltration.

IOC Summary

Malware Family: Mozi Total IOCs: 9 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://190.196.253.119:10701/Mozi.m", "http://223.123.44.122:42812/Mozi.m", "http://103.176.16.59:34532/Mozi.m", "http://116.140.6.114:46743/Mozi.m", "http://103.225.191.202:34773/Mozi.m", "http://153.117.40.170:44217/Mozi.m", "http://110.186.229.108:47843/Mozi.m", "http://115.57.182.131:41041/Mozi.m", "http://183.63.8.194:46154/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

Here are the documented false positive scenarios and corresponding exclusions for the ThreatFox: Mozi IOCs detection rule:

• Scenario: Legitimate Security Tool Updates

  • Context: The organization utilizes CrowdStrike Falcon or Microsoft Defender for Endpoint. These tools frequently pull threat intelligence feeds that include Mozi-related hashes (often used as a baseline or reference in their own telemetry) during nightly update cycles.
  • Filter/Exclusion: Exclude network traffic and process execution events originating from the specific service accounts of the EDR agent (e.g., C:\Program Files\CrowdStrike\csagent.exe or C:\Windows\System32\MsMpEng.exe) when they are communicating with known update servers.

• Scenario: Scheduled Vulnerability Scanning

  • Context: The enterprise runs a nightly vulnerability scan using Tenable Nessus or Qualys. These scanners often probe internal assets against a massive library of IOCs, including Mozi signatures, to validate asset posture and compliance status.
  • Filter/Exclusion: Create an exclusion for the IP address ranges of the dedicated scanning servers (e.g., 10.20.30.x) during their defined maintenance window (e.g., 02:00 – 04:00 UTC), filtering out any Mozi IOC matches generated by the scanner’s service process (java.exe or nessusd).

• Scenario: Third-Party Cloud Backup Operations

  • Context: The IT team uses Veeam Backup & Replication to perform incremental backups of critical file servers. Veeam’s internal engine may reference Mozi IOCs as part of its anti-malware integration module while indexing backup data streams.
  • Filter/Exclusion: Exclude process execution and network connection events where