ThreatFox: Mozi IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Mozi malware by monitoring for specific threat intelligence indicators of compromise (IOCs) within Azure Sentinel logs. Proactively hunting for these signatures is critical because Mozi’s ability to exfiltrate sensitive data and establish persistence makes early identification essential for minimizing dwell time and preventing lateral movement across cloud resources.

IOC Summary

Malware Family: Mozi Total IOCs: 2 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://153.117.41.127:47793/Mozi.a", "http://110.37.35.79:33903/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Mozi IOCs detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Protection Policy Updates via Microsoft Defender for Endpoint (MDE)

  • Scenario: The MDE management console pushes a new definition update or policy change that includes a script hash matching a known Mozi IOC. This often occurs during scheduled maintenance windows where the MsMpEng.exe process downloads and executes verification scripts containing specific file hashes associated with the Mozi campaign.
  • Filter/Exclusion: Create an exclusion rule targeting the parent process MsMpEng.exe or the specific service account (e.g., NT SERVICE\Antimalware Service Executable) when accessing files in the %ProgramData%\Microsoft\Windows Defender\Updates directory.

• Automated Patch Deployment via SCCM/MECM

  • Scenario: System Center Configuration Manager (SCCM) or Microsoft Endpoint Configuration Manager executes a scheduled task to deploy security patches. The deployment package includes a pre-requisite script that matches the Mozi IOC signature, running under the ccmexec.exe process on domain-joined workstations during business hours.
  • Filter/Exclusion: Exclude alerts where the parent process is ccmexec.exe and the user context is the local system account (NT AUTHORITY\SYSTEM) or a dedicated patching service account (e.g., DOMAIN\PatchingSvc).

• Third-Party DLP Agent Scans

  • Scenario: Enterprise Data Loss Prevention (DLP) agents, such as Symantec DLP or Forcepoint, perform scheduled deep scans of user home directories. These agents often utilize sandboxed execution environments that instantiate temporary files with hashes identical to the Mozi IOCs while analyzing large document repositories.
  • Filter/Exclusion: Add