ThreatFox: Mozi IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Mozi threat actor by monitoring for three specific indicators of compromise (IOCs) within Azure Sentinel logs. A proactive hunt is essential because Mozi’s targeted campaigns often involve early-stage reconnaissance that may evade standard alerting, requiring manual correlation to prevent potential lateral movement and data exfiltration.

IOC Summary

Malware Family: Mozi Total IOCs: 3 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://110.38.2.86:48915/Mozi.m", "http://39.34.140.102:40567/Mozi.a", "http://153.117.38.146:46962/Mozi.a"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Mozi IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Antivirus Definition Updates via WSUS or SCCM

  • Context: Enterprise endpoints often connect to internal update servers (e.g., Microsoft System Center Configuration Manager or Windows Server Update Services) that host Mozi-related security intelligence feeds. When the scheduled job Antimalware Service Exec runs, it may download and hash files matching Mozi IOCs as part of a routine definition refresh.
  • Filter/Exclusion: Create an exclusion rule for processes originating from C:\Program Files\Microsoft Antimalware\Engine\* or C:\Windows\System32\usoc.dll. Additionally, filter alerts where the source IP belongs to the internal update server subnet (e.g., 10.50.x.x) and the process name contains “Antimalware” or “WUA”.

• Scenario: Third-Party Backup Agent Scanning

  • Context: Enterprise backup solutions like Veeam, Rubrik, or Commvault often perform deep scans of file systems. If a Mozi IOC (such as a specific DLL hash) exists within the backup agent’s installation directory or its cache folder, the detection logic will trigger an alert every time the backup job initiates a scan cycle.
  • Filter/Exclusion: Exclude file paths containing standard backup agent directories, such as C:\Program Files\Veeam\Backup and Replication or C:\ProgramData\Rubrik. Configure the rule to ignore events where the parent process is vbrsvc.exe, rubrik-agent.exe, or commvault.cmd.

• Scenario: Developer CI/CD Pipeline Execution

  • Context: In DevOps environments, build