ThreatFox: Mozi IOCs

Hunt Hypothesis

This detection rule identifies adversary behavior associated with the Mozi malware family, which specifically targets systems to facilitate covert data exfiltration. A SOC team should proactively hunt for these indicators within Azure Sentinel because Mozi’s sophisticated exfiltration mechanisms often evade standard perimeter defenses, requiring deep visibility into internal network traffic and endpoint logs to prevent significant data loss.

IOC Summary

Malware Family: Mozi Total IOCs: 3 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://139.135.45.2:60511/Mozi.m", "http://139.135.59.231:54094/Mozi.a", "http://113.221.58.195:45339/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Mozi IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Automated Backup and Archive Operations

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik frequently scan large datasets for exfiltration patterns. When these tools compress and transfer data to off-site repositories, the network traffic signatures (large outbound streams from specific service accounts) often mimic Mozi’s data exfiltration behavior.
  • Suggested Filter: Create an exclusion based on the Source Process Name (VeeamTransport.exe, rubrik-agent) and restrict the alert to non-standard ports or exclude known backup destination IP ranges (e.g., AWS S3 buckets, Azure Blob Storage IPs).

• Scenario: Software Deployment and Patching Cycles

  • Context: During scheduled maintenance windows, tools like Microsoft Endpoint Configuration Manager (SCCM) or Ivanti Neurons push updates to endpoints. The deployment agents often initiate high-volume outbound connections to download packages from central servers, which can trigger the Mozi rule’s “data exfiltration” logic due to the volume and direction of traffic.
  • Suggested Filter: Implement a time-based exclusion for the specific maintenance window (e.g., 02:00 - 06:00 UTC) or exclude alerts where the Source User is a dedicated service account (e.g., DOMAIN\SCCM-Deploy-Svc).

• Scenario: Cloud Synchronization and Collaboration Tools

  • Context: Users utilizing Microsoft OneDrive for Business, Google Workspace Drive, or Box Enterprise often sync large files to the cloud. When a user uploads a large presentation or dataset, the continuous stream of data leaving the endpoint