ThreatFox: Mozi IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Mozi threat by matching four specific Indicators of Compromise (IOCs) within Azure Sentinel logs. Proactively hunting for these signals is critical because Mozi represents a sophisticated threat actor capable of stealthy lateral movement, requiring early intervention to prevent potential data exfiltration or system compromise before full-scale engagement occurs.

IOC Summary

Malware Family: Mozi Total IOCs: 4 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://153.117.32.130:49657/Mozi.a", "http://175.107.3.244:55339/Mozi.7", "http://124.94.244.212:33038/Mozi.a", "http://203.101.186.212:33774/Mozi.a"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: Mozi IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Endpoint Protection Scans

  • Context: Enterprise endpoint protection suites (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon) often perform scheduled deep scans that generate network traffic to update definition databases or report telemetry. If the Mozi IOCs include specific hash signatures or domain patterns used by these vendors’ update servers, a routine scan may trigger the rule.
  • Suggested Filter/Exclusion: Create an exclusion for processes running under the context of known security agents (e.g., MsMpEng.exe, FalconSensorService.exe) connecting to specific vendor update domains (e.g., *.microsoft.com, *.crowdstrike.com). Alternatively, filter out alerts where the source IP is a known internal management server.

• Scenario: Admin-Initiated Patch Deployment via SCCM

  • Context: During monthly patch cycles, System Center Configuration Manager (SCCM) or Microsoft Endpoint Configuration Manager pushes updates to workstations. The deployment agent may download payloads from distribution points that match Mozi’s IOCs (particularly if the rule monitors for specific file hashes or URLs associated with software repositories). This is a legitimate administrative task rather than malicious activity.
  • Suggested Filter/Exclusion: Exclude alerts generated by the ccmexec.exe process during standard maintenance windows (e.g., 02:00–04:00 local time). Additionally, whitelist distribution point IP ranges and SCCM management points from the detection logic.

• Scenario: Legacy Application Data Synchronization

  • Context: Older enterprise applications (such as legacy ERP modules or specialized HR tools) often rely on third-party middleware for data synchronization. These systems may