ThreatFox: Mozi IOCs

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging Mozi malware to exfiltrate sensitive data via encrypted command-and-control channels initiated by phishing campaigns or software vulnerabilities. Proactive hunting in Azure Sentinel is critical to detect anomalous outbound traffic patterns and DGA activity that may indicate early-stage lateral movement before significant data loss occurs.

IOC Summary

Malware Family: Mozi Total IOCs: 2 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://42.232.238.126:40504/Mozi.m", "http://182.126.198.5:57587/Mozi.a"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Mozi IOCs detection rule, including suggested filters or exclusions tailored for an enterprise environment:

• Scenario: Cloud Backup Agents Performing Scheduled Exfiltration

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik often initiate large outbound data transfers to cloud storage repositories (e.g., AWS S3, Azure Blob) during off-hours. These agents utilize encrypted channels and connect to dynamic IP ranges that may resemble Mozi’s C2 behavior, particularly if the backup destination uses a DGA-like subdomain structure for load balancing.
  • Filter/Exclusion: Create an exclusion rule based on the specific Service Principal Name (SPN) or Process Hash of the backup agent (e.g., veeambackup.exe with SHA256 hash ...). Additionally, whitelist known cloud storage CIDR blocks associated with your organization’s backup provider in the firewall policy to bypass traffic inspection for these specific destinations.

• Scenario: Automated Patch Management and Software Updates

  • Context: Tools such as Microsoft Endpoint Configuration Manager (SCCM) or Jamf Pro frequently download updates from vendor repositories that utilize complex URL redirections and encrypted tunnels. When a large patch deployment occurs, the traffic pattern mimics Mozi’s “phishing arrival” and subsequent C2 communication, especially if the update server uses a generated subdomain for versioning (e.g., update-v4-xyz.vendor.com).
  • Filter/Exclusion: Implement a filter that excludes traffic originating from the Patch Management Service Account (e.g., DOMAIN\SCCM_Service_Acc) and restricts the rule to trigger only on non-standard ports. Exclude known update vendor domains (e.g., *.microsoft.com, *.jamfsoftware.com) from