ThreatFox: Mozi IOCs

Hunt Hypothesis

This hunt detects adversary activity by identifying network traffic and endpoint events matching twelve specific Indicators of Compromise (IOCs) linked to the Mozi threat actor. Proactively hunting for these signals in Azure Sentinel is critical because Mozi’s sophisticated supply chain attacks often evade standard signature-based defenses, requiring early detection to prevent lateral movement and data exfiltration.

IOC Summary

Malware Family: Mozi Total IOCs: 12 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://153.117.9.227:35316/Mozi.m", "http://202.141.104.249:60065/Mozi.m", "http://223.123.126.147:40242/Mozi.m", "http://101.53.225.7:52865/Mozi.m", "http://223.123.124.0:54646/Mozi.m", "http://115.55.183.61:57147/Mozi.a", "http://182.116.13.153:48985/Mozi.m", "http://61.71.179.32:58000/Mozi.m", "http://223.123.43.197:49453/Mozi.m", "http://153.117.50.22:60485/Mozi.m", "http://111.92.153.194:47148/Mozi.m", "http://105.184.74.46:44527/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Mozi IOCs detection rule, along with recommended filters and exclusions tailored for an enterprise environment:

• Scenario 1: Scheduled Antivirus Definitions Update via WSUS

  • Context: The Windows Server Update Services (WSUS) server pushes monthly security definition updates to the endpoint fleet. The update package often contains a hash or file signature that matches one of the Mozi IOCs, triggering an alert when the wuauserv service downloads and installs these definitions on thousands of machines simultaneously.
  • Filter/Exclusion: Create a suppression rule for the process wuauclt.exe (Windows Update Client) or WuaServer.exe running under the SYSTEM account, specifically when the source IP is the internal WSUS server subnet (e.g., 10.x.x.0/24). Exclude alerts where the file path contains \Program Files\Microsoft Updates.

• Scenario 2: Endpoint Detection and Response (EDR) Telemetry Upload

  • Context: The enterprise EDR agent (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled telemetry upload to its cloud management console. The communication payload includes a specific hash or certificate thumbprint that overlaps with the Mozi IOC list, causing false positives during the daily 02:00 AM maintenance window.
  • Filter/Exclusion: Exclude alerts generated by the EDR agent process (e.g., C:\Program Files\CrowdStrike\csagent.exe or C:\Windows\System32\DPSvc.exe) when the destination IP is a known public cloud range for that vendor (e.g., CrowdStrike US East IPs). Additionally, filter out events occurring strictly between 01:00 and 04:00 local time.

• **Scenario