ThreatFox: Mozi IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection identifies adversary activity by monitoring network and endpoint telemetry for six specific Indicators of Compromise (IOCs) linked to the Mozi threat actor. A proactive hunt is essential in Azure Sentinel because Mozi’s sophisticated supply chain attack patterns often evade standard rule-based alerts, requiring manual correlation to uncover early-stage compromises before lateral movement occurs.

IOC Summary

Malware Family: Mozi Total IOCs: 6 IOC Types: url

Type	Value	Threat Type	First Seen	Confidence
url	`hxxp://103[.]26[.]82[.]216:35366/Mozi.m`	payload_delivery	2026-08-30	75%
url	`hxxp://139[.]135[.]42[.]31:43969/Mozi.m`	payload_delivery	2026-08-30	75%
url	`hxxp://116[.]109[.]33[.]252:33235/Mozi.a`	payload_delivery	2026-08-30	75%
url	`hxxp://112[.]25[.]235[.]194:60134/Mozi[.]7`	payload_delivery	2026-08-30	75%
url	`hxxp://175[.]107[.]0[.]8:44034/Mozi[.]7`	payload_delivery	2026-08-30	75%
url	`hxxp://153[.]117[.]37[.]70:33874/Mozi.m`	payload_delivery	2026-08-30	75%

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://103.26.82.216:35366/Mozi.m", "http://139.135.42.31:43969/Mozi.m", "http://116.109.33.252:33235/Mozi.a", "http://112.25.235.194:60134/Mozi.7", "http://175.107.0.8:44034/Mozi.7", "http://153.117.37.70:33874/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Mozi

False Positive Guidance

False Positive Scenarios for “ThreatFox: Mozi IOCs” Rule

Scenario: Automated Security Tool Updates
- Context: Enterprise Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, frequently download definition updates or threat intelligence feeds from the cloud. The Mozi detection logic may flag these routine update packages if they share a hash or network signature with known Mozi IOCs.
- Filter/Exclusion: Configure an exclusion rule to ignore alerts originating from specific service accounts (e.g., svc-antivirus-update) and processes running within the trusted path C:\Program Files\CrowdStrike\ or C:\ProgramData\Microsoft Defender\.
Scenario: Scheduled Backup Jobs
- Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik often utilize external storage gateways that communicate with cloud repositories. If the Mozi IOC includes a specific network port or IP range used by these backup vendors, nightly scheduled jobs (e.g., “Nightly Full Backup”) will trigger false positives during their execution window.
- Filter/Exclusion: Create a time-based exclusion for alerts occurring between 01:00 and 05:00 UTC on weekdays, specifically filtering out traffic initiated by the backup service process Veeam.Backup.Service.exe or rubrik-agent.
Scenario: Third-Party SaaS Integration Sync
- Context: IT administrators often deploy Microsoft Intune or ServiceNow to manage device compliance and asset inventory. These tools perform periodic synchronization tasks that query external APIs. If the Mozi detection logic monitors specific HTTP/HTTPS traffic patterns, these legitimate sync operations may be misidentified as suspicious activity associated with the Mozi threat family.