ThreatFox: Mozi IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Mozi threat actor by matching network and host telemetry against nine specific Indicators of Compromise (IOCs). A proactive hunt is essential in Azure Sentinel because Mozi’s sophisticated supply chain and cloud-focused attack patterns require early identification of these IOCs to prevent lateral movement and data exfiltration before full-scale compromise occurs.

IOC Summary

Malware Family: Mozi Total IOCs: 9 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://139.135.42.179:41902/Mozi.m", "http://61.174.163.220:39657/Mozi.m", "http://103.148.128.154:35695/Mozi.m", "http://103.186.77.64:51823/Mozi.m", "http://125.41.245.63:39395/Mozi.m", "http://175.107.233.106:48152/Mozi.a", "http://182.113.35.171:56533/Mozi.m", "http://223.123.72.129:48681/Mozi.m", "http://113.236.100.208:54189/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Mozi IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Automated Endpoint Protection Updates via Scheduled Tasks

  • Context: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) often run scheduled maintenance jobs during off-hours that download definition updates or telemetry data from cloud repositories. These processes may generate network connections to IP addresses or domains that overlap with Mozi’s infrastructure, triggering the IOC match.
  • Filter/Exclusion: Create a rule exclusion based on the specific Process Name (e.g., C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe) and restrict the alert to only trigger if the process is not running under a known service account (e.g., SYSTEM or LocalService). Alternatively, exclude traffic originating from specific Scheduled Task IDs known for maintenance.

• Scenario: Third-Party Cloud Backup Agents Scanning External Repositories

  • Context: Data backup solutions like Veeam Backup & Replication or Rubrik often communicate with external S3-compatible storage buckets or management portals. If the Mozi IOCs include IP ranges used by these cloud providers for metadata exchange, the backup agent’s routine heartbeat or status check will generate a false positive.
  • Filter/Exclusion: Implement an exclusion based on the Source Process (e.g., Veeam.Backup.Service.exe) and filter out events where the destination port is standard HTTPS (443) or S3 API ports, provided the connection duration is short (< 5 minutes) indicating a status check rather than a data exfiltration event.

• Scenario: IT Admin Performing Manual Security Tool Configuration

  • Context: During routine maintenance windows, security administrators