ThreatFox: Mozi IOCs

Hunt Hypothesis

This detection rule identifies adversary activity by monitoring for four specific Indicators of Compromise (IOCs) linked to the Mozi malware campaign within the Azure Sentinel environment. Proactively hunting for these IOCs is critical because Mozi’s sophisticated evasion techniques allow it to persist undetected, making early identification essential to prevent lateral movement and data exfiltration before full compromise occurs.

IOC Summary

Malware Family: Mozi Total IOCs: 4 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://223.123.71.61:57047/Mozi.m", "http://151.233.179.226:35297/Mozi.7", "http://27.215.181.160:36250/Mozi.m", "http://103.174.243.198:48214/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

Here are four specific false positive scenarios for the ThreatFox: Mozi IOCs detection rule, along with targeted exclusion strategies suitable for an enterprise environment:

• Scenario: Scheduled Antivirus Definition Updates via WSUS

  • Context: The Windows Update Service (or a third-party agent like Microsoft Endpoint Configuration Manager) periodically downloads and installs definition updates from the vendor’s repository. If the Mozi detection logic flags specific hash values or network destinations associated with these update servers as suspicious, it may trigger alerts during standard maintenance windows.
  • Filter/Exclusion: Create an exclusion rule that suppresses alerts for processes named wuauserv.exe and ccmexec.exe when the destination IP addresses belong to known Microsoft Update CDN ranges or the specific vendor’s update server subnet (e.g., 10.20.50.x). Additionally, exclude events occurring during the defined maintenance window (e.g., Sundays 02:00–04:00 UTC).

• Scenario: Automated Backup Jobs Executing via Veeam or Commvault

  • Context: Enterprise backup solutions often utilize dedicated service accounts to scan file systems and transfer data. If the Mozi IOCs include specific file hashes or network signatures that overlap with the backup software’s communication protocols, the rule may flag legitimate backup traffic as potential malware activity, particularly during nightly full backups.
  • Filter/Exclusion: Exclude alerts where the source process is VeeamTransportService.exe (for Veeam) or commvaultagent.exe (for Commvault). Furthermore, add a filter to ignore events originating from the specific service account used for backups (e.g., DOMAIN\svc_backup_admin) and restrict detection to non-backup network ports.

• Scenario: Deployment of Security Tools via SCCM/Intune

  • **Context