ThreatFox: Mozi IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Mozi threat actor by monitoring specific Indicators of Compromise (IOCs) known to facilitate their initial access and lateral movement. SOC teams should proactively hunt for these signals in Azure Sentinel to rapidly identify early-stage intrusions, as Mozi’s sophisticated operations often target critical infrastructure where timely containment is essential to prevent data exfiltration or service disruption.

IOC Summary

Malware Family: Mozi Total IOCs: 2 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://103.244.172.87:45274/Mozi.a", "http://130.12.209.147:55604/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

False Positive Scenarios for “ThreatFox: Mozi IOCs” Rule

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise endpoints running Microsoft Defender for Endpoint or Symantec Endpoint Protection often trigger the Mozi detection logic during their nightly definition update cycles. The update process involves downloading and executing a large number of new hash signatures that may overlap with Mozi’s known IOCs, causing the rule to flag legitimate signature files as suspicious activity.
  • Suggested Filter: Exclude processes where ProcessName matches MsMpEng.exe (Defender) or RtkExe64.exe (Symantec) and the event timestamp falls within the configured maintenance window (e.g., 02:00–04:00 local time).

• Scenario: Automated Patch Deployment via Configuration Management

  • Context: During weekly patch cycles, administrators using Microsoft System Center Configuration Manager (SCCM) or Ansible Tower deploy security patches. The installation agents often download and execute temporary binaries that match Mozi’s file hashes or network connection patterns, particularly when installing updates for the Java Runtime Environment or .NET Framework which are common vectors in enterprise stacks.
  • Suggested Filter: Create an exclusion rule based on CommandLine containing keywords like “SCCM”, “Ansible”, or specific patch IDs (e.g., KB503...), and filter out events originating from the dedicated management server IP range (e.g., 192.168.10.5).

• Scenario: Third-Party Backup Agent Operations

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault run scheduled jobs that scan and index large file systems. These agents frequently utilize Mozi-compatible hashing algorithms to verify data