ThreatFox: Mozi IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Mozi threat actor by monitoring for specific Indicators of Compromise (IOCs) known to facilitate initial access and lateral movement within cloud environments. Proactively hunting for these signals in Azure Sentinel is critical because Mozi’s sophisticated targeting of enterprise networks requires early identification of its unique IOCs to prevent data exfiltration before the adversary establishes persistence.

IOC Summary

Malware Family: Mozi Total IOCs: 2 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://103.26.86.217:52895/Mozi.a", "http://103.213.112.214:49082/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Mozi IOCs detection rule, tailored for a legitimate enterprise environment:

• Endpoint Security Agent Updates via Cloud Management Console

  • Scenario: The enterprise Endpoint Detection and Response (EDR) solution, such as CrowdStrike Falcon or SentinelOne, automatically downloads and executes the Mozi IOC update package during its scheduled nightly maintenance window. This process involves the EDR agent communicating with the vendor’s cloud repository to fetch new threat intelligence feeds, which matches the network traffic patterns of the Mozi IOCs.
  • Suggested Filter/Exclusion: Create an exclusion based on the Process Name and Parent Process. Exclude events where the initiating process is FalconSensor.exe (CrowdStrike) or SentinelOneAgent.exe, specifically when the parent process is the Windows Service Host (svchost.exe) running under the LocalSystem account.

• Automated Vulnerability Scanning by Qualys

  • Scenario: The organization runs a weekly vulnerability assessment using Qualys Cloud Agent. During the scan, the agent performs active reconnaissance and probes external threat intelligence feeds to cross-reference known malware signatures. This activity triggers network connections to Mozi-associated IP addresses or domains as part of its baseline health check and signature synchronization routine.
  • Suggested Filter/Exclusion: Implement a filter on the Source Port and Destination Domain. Exclude traffic originating from the Qualys agent service port (typically 1234 or 8080) connecting to known Mozi domains, provided the connection is initiated by the scheduled task \Qualys\Cloud Agent Update.

• Software Deployment via Microsoft Endpoint Configuration Manager (MECM)

  • Scenario: The IT Operations team deploys a security patch containing updated threat definitions using **Microsoft