ThreatFox: Mozi IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Mozi malware campaign by monitoring five specific Indicators of Compromise (IOCs) within Azure Sentinel logs. Proactive hunting for these signals is essential to rapidly detect early-stage infections and mitigate potential lateral movement or data exfiltration before they escalate into a broader incident.

IOC Summary

Malware Family: Mozi Total IOCs: 5 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://27.202.57.233:59905/Mozi.m", "http://14.1.106.91:54093/Mozi.m", "http://182.112.30.222:60319/Mozi.m", "http://139.135.44.17:33905/Mozi.m", "http://14.1.106.10:37095/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: Mozi IOCs detection rule, tailored for an enterprise environment:

• Scenario: Security Team Manual Threat Hunting Queries

  • Context: The internal threat intelligence team regularly runs manual queries against the SIEM or EDR platform to cross-reference known Mozi indicators (hashes, domains) with current network traffic. These queries often generate alerts when a match is found during the hunting session itself, rather than indicating an active compromise on an endpoint.
  • Filter/Exclusion: Create a rule exclusion based on the source process name siem_query_service.exe or user accounts belonging to the SOC_Analysts security group (e.g., CN=Security_Hunt_Team). Additionally, exclude events where the event type is “Query Execution” rather than “Process Creation.”

• Scenario: Scheduled Endpoint Vulnerability Scans

  • Context: The enterprise utilizes Tenable Nessus or Qualys for scheduled vulnerability assessments. During these scans, the agents often probe specific Mozi-related domains and file hashes as part of a comprehensive asset inventory check, triggering a match against the Mozi IOC list without malicious intent.
  • Filter/Exclusion: Exclude events originating from the process tenable_agent.exe or qualys_pc_agent.exe. Implement a time-based filter to suppress alerts during known maintenance windows (e.g., 02:00–04:00 UTC daily) when these scans are typically executed.

• Scenario: Automated Patch Management Deployments

  • Context: The IT Operations team uses Microsoft Endpoint Configuration Manager (SCCM) or Ivanti Neurons to deploy security patches and updates. Some of the installed update packages contain components that share file hashes or network destinations with Mozi IOCs, causing