ThreatFox: Mozi IOCs

Hunt Hypothesis

This detection rule identifies adversary activity by monitoring network traffic and endpoint logs against six specific Indicators of Compromise (IOCs) linked to the Mozi threat actor. Proactively hunting for these signals in Azure Sentinel is critical because Mozi’s sophisticated supply chain and cloud-focused attack patterns require early identification to prevent lateral movement and data exfiltration before they escalate into a full-scale incident.

IOC Summary

Malware Family: Mozi Total IOCs: 6 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://221.13.234.94:35751/Mozi.m", "http://146.158.4.238:41633/Mozi.m", "http://27.44.145.195:60512/Mozi.m", "http://72.255.15.211:53933/Mozi.m", "http://153.117.32.70:43183/Mozi.a", "http://202.70.139.79:49671/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Mozi IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Automated Endpoint Security Scans

  • Context: Enterprise EDR agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently perform scheduled deep scans or definition updates that generate network traffic matching Mozi’s known IOCs. These scans often involve hash lookups and telemetry uploads to cloud services that overlap with the rule’s signature.
  • Filter/Exclusion: Exclude process names containing FalconSensor.exe, MsMpEng.exe, or DefenderService from the detection logic, specifically when the source IP belongs to the internal management subnet (e.g., 10.20.x.x).

• Scenario: Third-Party Backup and Archiving Jobs

  • Context: Scheduled backup agents like Veeam Backup & Replication or Commvault often utilize compression algorithms and network protocols that generate traffic patterns indistinguishable from Mozi’s command-and-control (C2) behavior. These jobs typically run during off-hours but may trigger the rule if they access external cloud storage endpoints included in the IOC list.
  • Filter/Exclusion: Create a whitelist for specific service accounts (e.g., svc-veeam-backup, commvault-agent) and exclude traffic originating from these accounts when the destination port is 443 or 80, provided the process path matches the known backup installation directory.

• Scenario: Software Deployment via Configuration Management

  • Context: IT administrators using tools like Ansible, SCCM (System Center Configuration Manager), or Puppet often push software updates or scripts that download artifacts from public repositories. If these repositories host files with hashes matching Mozi’s IOCs, the deployment engine will trigger a hit during