ThreatFox: Mozi IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Mozi threat actor by monitoring specific Indicators of Compromise (IOCs) known to facilitate initial access and lateral movement within cloud environments. Proactively hunting for these IOCs in Azure Sentinel is critical due to Mozi’s high severity profile, enabling the SOC team to rapidly detect early-stage intrusions and mitigate potential data exfiltration before broader compromise occurs.

IOC Summary

Malware Family: Mozi Total IOCs: 3 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://153.117.6.79:34093/Mozi.m", "http://115.48.134.112:38753/Mozi.m", "http://153.117.8.52:40632/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Mozi IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Scheduled Endpoint Protection Scans

  • Context: Enterprise EDR solutions (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) often perform scheduled deep scans that generate high-volume telemetry. If the Mozi IOCs include specific file hashes or network patterns associated with common scanning behaviors, the rule may trigger during nightly maintenance windows when these agents update their signature databases or scan user directories.
  • Filter/Exclusion: Create a time-based exclusion for the detection logic to ignore alerts occurring between 01:00 and 05:00 UTC on weekdays, specifically filtering out processes with ImageName matching *FalconSensor.exe, *MsMpEng.exe, or *DefenderService.exe.

• Scenario: Automated Patch Management Deployment

  • Context: During automated patch cycles managed by tools like SCCM (System Center Configuration Manager) or Ivanti, the deployment engine may download and execute installer packages that match Mozi’s network signatures. This is common when deploying security updates to a large fleet where the installation service communicates with external update servers using patterns similar to the Mozi IOCs.
  • Filter/Exclusion: Exclude alerts where the ParentProcessName is ccmsetup.exe, IvantiAgent.exe, or wsappx.exe, and the CommandLine contains keywords such as “Update”, “Patch”, or specific deployment IDs associated with internal patching jobs.

• Scenario: Legitimate Cloud Backup Operations

  • Context: Enterprise backup solutions (e.g., Veeam, Rubrik, or Acronis) frequently initiate data transfer jobs that involve reading large volumes of files and establishing persistent connections