ThreatFox: Mozi IOCs

Hunt Hypothesis

This detection rule identifies adversary activity by matching network and endpoint telemetry against five specific Indicators of Compromise (IOCs) linked to the Mozi threat actor. A proactive hunt is essential in Azure Sentinel to rapidly uncover early-stage infections or lateral movement attempts associated with Mozi, enabling swift containment before the adversary establishes a persistent foothold within the environment.

IOC Summary

Malware Family: Mozi Total IOCs: 5 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://103.225.191.17:49732/Mozi.m", "http://59.103.217.15:54294/Mozi.m", "http://223.123.72.204:42931/Mozi.7", "http://153.117.6.63:41336/Mozi.m", "http://221.15.226.18:57698/Mozi.a"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Mozi IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Automated Vulnerability Scanning by Qualys or Tenable

  • Context: Enterprise vulnerability scanners (e.g., Qualys Cloud Agent, Tenable Nessus) frequently probe internal assets using known Mozi IOCs as part of their signature database updates. When the scanner queries a specific hash or URL associated with Mozi to verify asset integrity, it triggers the hunt package.
  • Filter/Exclusion: Exclude traffic originating from the IP ranges of your vulnerability management servers (e.g., 10.20.50.x for Qualys) where the process name matches qualyspc.exe or tenable-agent. Additionally, filter out events where the user context is a dedicated service account like svc-qualys-scanner.

• Scenario: Scheduled Endpoint Protection Updates via CrowdStrike Falcon

  • Context: The endpoint protection suite (e.g., CrowdStrike Falcon) runs scheduled jobs to download and validate new threat intelligence feeds. These jobs often reference Mozi IOCs during the update cycle, causing the detection logic to flag these legitimate internal network flows as potential threats.
  • Filter/Exclusion: Create an exclusion rule for events occurring between 01:00 and 04:00 UTC (standard maintenance window) where the source process is FalconSensor.exe or falcon.sys. Filter specifically for the “Scheduled Task” trigger type named CrowdStrike_Update_Job.

• Scenario: Internal Security Information Exchange (SIE) via Splunk Enterprise

  • Context: The organization’s SIEM (Splunk Enterprise) periodically ingests external threat intelligence feeds that include Mozi indicators. During the ingestion