ThreatFox: Mozi IOCs

Hunt Hypothesis

This detection rule identifies adversary activity by correlating eight specific Indicators of Compromise (IOCs) linked to the Mozi threat actor within Azure Sentinel logs. Proactively hunting for these IOCs is critical because Mozi’s sophisticated attack patterns often evade standard signature-based defenses, requiring active investigation to uncover early-stage compromises before they escalate into significant data breaches.

IOC Summary

Malware Family: Mozi Total IOCs: 8 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://124.29.214.162:51383/Mozi.m", "http://179.49.213.85:54579/Mozi.m", "http://72.255.32.51:57334/Mozi.m", "http://39.81.179.181:41855/Mozi.m", "http://123.14.253.47:58492/Mozi.m", "http://144.48.135.109:49866/Mozi.m", "http://103.26.82.237:43196/Mozi.m", "http://163.223.136.58:54559/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Mozi IOCs detection rule, including actionable filters and exclusions tailored for an enterprise environment:

• Scenario: Security Tool Telemetry Collection

  • Context: Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon or Microsoft Defender for Endpoint periodically query threat intelligence feeds to update their local databases. These agents often generate network traffic or process executions that match the Mozi IOCs as part of their routine “threat library synchronization.”
  • Filter/Exclusion: Create a filter to exclude alerts where the Process Name matches known EDR service executables (e.g., falcon.sys, MsMpEng.exe) and the User Account is a system account (e.g., NT SERVICE\FalconService).

• Scenario: Scheduled Threat Intelligence Feed Updates

  • Context: Enterprise SIEM or Threat Intelligence platforms, such as Splunk Enterprise Security or Tenable.io, run scheduled jobs to ingest external IOC feeds. A nightly job might download a CSV or API payload containing Mozi signatures, triggering the detection logic during the ingestion window (e.g., 02:00–04:00 UTC).
  • Filter/Exclusion: Implement a time-based exclusion rule that suppresses alerts for this specific detection between 01:30 and 04:30 on weekdays, or exclude traffic originating from the IP range of the internal Threat Intelligence server.

• Scenario: Admin-Driven Vulnerability Scanning

  • Context: During a scheduled vulnerability assessment using tools like Qualys Cloud Agent or Trend Micro Vantage, administrators may manually trigger scans that reference Mozi indicators to validate asset posture. The scanner’s background process often mimics the behavior of the targeted malware by