ThreatFox: Mozi IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Mozi threat actor by monitoring specific indicators of compromise (IOCs) within Azure Sentinel logs. Proactive hunting for these signals is critical because Mozi’s sophisticated attack patterns often target cloud infrastructure, requiring early identification to mitigate potential data exfiltration and lateral movement before full-scale impact occurs.

IOC Summary

Malware Family: Mozi Total IOCs: 2 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://190.196.253.117:11933/Mozi.m", "http://103.174.243.203:54166/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Mozi IOCs detection rule, along with targeted filters and exclusions to reduce noise in an enterprise environment:

• Scenario: The Endpoint Detection and Response (EDR) agent on a build server initiates a connection to a public threat intelligence feed URL that matches a Mozi hash or domain.

  • Context: Automated vulnerability scanners like Tenable Nessus or Qualys often pull updates from shared infrastructure providers that may host Mozi-related assets or use similar certificate chains.
  • Filter/Exclusion: Create a whitelist rule for the specific build server’s hostname (e.g., build-server-01) and exclude traffic originating from the Tenable Nessus process ID (nsagent.exe or qualyspcapd) connecting to known public IP ranges associated with the feed provider.

• Scenario: A scheduled PowerShell script running on a Domain Controller queries an external API for threat data, triggering the Mozi IOC match.

  • Context: The IT Operations team runs a nightly job named UpdateThreatIntel.ps1 using Microsoft Defender for Endpoint APIs to sync custom indicators, which inadvertently matches a Mozi signature due to overlapping hash values in the shared dataset.
  • Filter/Exclusion: Exclude alerts where the process name is powershell.exe and the parent process is TaskScheduler.exe, specifically when the script path contains \Scripts\ThreatIntel\. Additionally, filter by the specific scheduled task ID (e.g., UpdateThreatIntel_Daily).

• Scenario: A third-party Security Information and Event Management (SIEM) connector establishes a persistent connection to a cloud-based threat intelligence service.

  • Context: The enterprise uses Splunk Enterprise or IBM QRadar, which utilizes the Mozi feed