ThreatFox: Mozi IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Mozi threat actor by matching network and endpoint telemetry against three specific Indicators of Compromise (IOCs). Proactive hunting for these signals in Azure Sentinel is critical because Mozi’s sophisticated supply chain attacks often exhibit low initial visibility, requiring early intervention to prevent lateral movement within the enterprise environment.

IOC Summary

Malware Family: Mozi Total IOCs: 3 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://36.255.44.120:59604/Mozi.m", "http://153.117.46.172:51188/Mozi.m", "http://39.86.251.237:54344/Mozi.a"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Mozi IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Legitimate Endpoint Protection Scans

  • Context: Enterprise EDR solutions (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently download definition updates or threat intelligence feeds that may contain hash values matching the Mozi IOCs. These scans often run as background services mimicking the behavior of the detected indicators.
  • Filter/Exclusion: Create an exclusion rule based on Process Name and User Context. Exclude alerts where ProcessName matches known EDR agents (e.g., FalconSensor.exe, MsMpEng.exe) AND UserName is a system account (e.g., NT AUTHORITY\SYSTEM or DOMAIN\AdminService).

• Scenario: Scheduled Backup and Archiving Jobs

  • Context: Automated backup tools like Veeam, Rubrik, or Commvault often generate temporary files or execute scripts that interact with the same file paths or network ports monitored by the Mozi rule. These jobs run on a strict schedule (e.g., nightly at 02:00) and may trigger IOCs related to file creation or network connection patterns.
  • Filter/Exclusion: Implement a time-based exclusion combined with process filtering. Exclude events occurring between 01:00 and 04:00 on weekdays where the ProcessName matches backup agents (e.g., vss.exe, rubrik-agent) and the CommandLine contains specific keywords like “backup” or “archive”.

• Scenario: Software Deployment via Configuration Management

  • Context: IT administrators use tools like SCCM, Ansible, or Puppet to push software updates or configuration changes. During