This hunt hypothesis targets adversaries leveraging the Mozi backdoor to establish persistent remote command execution and data exfiltration capabilities following initial compromise via phishing or exploit kits. Proactive hunting in Azure Sentinel is critical because Mozi’s ability to blend with legitimate traffic often evades signature-based detection, requiring behavioral analysis to identify subtle indicators of unauthorized outbound communications and potential data leakage.
Malware Family: Mozi Total IOCs: 4 IOC Types: url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxp://39[.]34[.]189[.]248:42346/Mozi.m | payload_delivery | 2026-08-29 | 75% |
| url | hxxp://39[.]89[.]242[.]234:38903/Mozi.m | payload_delivery | 2026-08-29 | 75% |
| url | hxxp://113[.]90[.]49[.]232:46655/Mozi.m | payload_delivery | 2026-08-29 | 75% |
| url | hxxp://14[.]1[.]104[.]86:52889/Mozi.m | payload_delivery | 2026-08-29 | 75% |
// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://39.34.189.248:42346/Mozi.m", "http://39.89.242.234:38903/Mozi.m", "http://113.90.49.232:46655/Mozi.m", "http://14.1.104.86:52889/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
UrlClickEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: Mozi IOCs detection rule:
Scenario: Legitimate outbound connectivity from the Microsoft Defender Antivirus service (MsMpEng.exe) to update servers. The Mozi rule often flags standard telemetry traffic sent by EDR agents as suspicious backdoor behavior because these agents frequently initiate connections to cloud endpoints for signature updates and threat intelligence feeds, mimicking the data exfiltration patterns of Mozi.
C:\Program Files\Microsoft Defender Antivirus\bin\MsMpEng.exe where the destination IP belongs to the Microsoft Azure or Update CDN ranges (e.g., *.update.microsoft.com).Scenario: Scheduled backup jobs executed by enterprise tools like Veeam Backup & Replication or Commvault. These agents run as scheduled tasks during off-hours, establishing persistent outbound connections to backup repositories and cloud storage buckets to transfer large data sets, which triggers the “data exfiltration” logic of the Mozi rule.
VeeamService.exe or CommServe.exe originating from known backup server subnets (e.g., 10.20.40.0/24) connecting to specific storage IP ranges, specifically during the defined maintenance window (e.g., 02:00–06:00).Scenario: Admin-initiated remote management sessions using tools like Microsoft System Center Configuration Manager (SCCM) or Ivanti Neurons. When administrators push software updates or run remote scripts to endpoints, the management agents initiate outbound traffic to download payloads and report status, which can be misidentified as Mozi’s “remote command execution” capability.