ThreatFox: Mozi IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Mozi threat actor by monitoring specific Indicators of Compromise (IOCs) within Azure Sentinel logs. Proactive hunting for these signals is critical due to their high severity, enabling the SOC team to rapidly detect and respond to potential early-stage intrusions before they escalate into broader compromises.

IOC Summary

Malware Family: Mozi Total IOCs: 2 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://125.45.57.193:59157/Mozi.m", "http://72.255.33.15:59765/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Mozi IOCs detection rule, including targeted filters and exclusions to reduce noise in an enterprise environment:

• Scenario: Scheduled Antivirus or EDR Full Scans

  • Context: Enterprise Endpoint Detection and Response (EDR) platforms like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec Endpoint Protection often perform scheduled full system scans during off-hours. These agents may query threat intelligence feeds that include Mozi signatures, triggering the detection when they resolve a known benign hash associated with the Mozi feed update process itself.
  • Filter/Exclusion: Exclude traffic originating from EDR management servers or specific scan service accounts (e.g., svc-crowdscan, defender-svc) where the destination port corresponds to the threat intelligence update channel (typically TCP 443) and the user agent string contains “Mozi-Feed-Sync”.

• Scenario: Automated Patch Management Deployment

  • Context: During automated patching cycles managed by tools like Microsoft SCCM (Configuration Manager) or Ivanti Neurons, deployment agents push updates to endpoints. If the Mozi IOC list includes a specific software version hash that matches a widely deployed enterprise application (e.g., a specific Adobe Reader or Java Runtime update), the rule triggers on every successful installation event across hundreds of machines.
  • Filter/Exclusion: Create an exclusion based on the Process Name matching known patching executables (e.g., ccmsetup.exe, ivanti-agent.exe) and restrict the alert to only trigger if the process is running under a non-admin user context, as legitimate patch deployments usually run under system or local admin accounts.

• Scenario: Third-Party Threat Intelligence Feed Integration

  • Context: Security Information and Event Management