ThreatFox: Mozi IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Mozi threat actor by monitoring four specific indicators of compromise within Azure Sentinel logs. Proactive hunting is essential because Mozi’s sophisticated operations often involve stealthy initial access and lateral movement that may evade standard automated alerts until significant impact occurs.

IOC Summary

Malware Family: Mozi Total IOCs: 4 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://223.123.73.182:54176/Mozi.m", "http://223.123.43.132:40473/Mozi.m", "http://111.92.157.204:47463/Mozi.m", "http://175.107.36.232:51731/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Mozi IOCs detection rule, along with targeted filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Antivirus Definition Updates via Windows Update Service

  • Context: The Mozi threat family often utilizes specific hash signatures that overlap with legitimate update packages. In many enterprises, the Windows Update service (wuauserv) or third-party AV agents (e.g., Microsoft Defender, CrowdStrike) automatically download and execute definition updates during maintenance windows. If these updates contain a file matching one of the 4 Mozi IOCs (specifically a shared DLL or executable hash), the rule triggers unnecessarily.
  • Suggested Filter/Exclusion: Exclude processes where Process Name equals wuauclt.exe, msiexec.exe, or DefenderSvc.exe AND Parent Process Name is svchost.exe. Additionally, add a time-based filter to suppress alerts during the defined maintenance window (e.g., 02:00–04:00 local time).

• Scenario: Deployment of Enterprise Endpoint Management Tools

  • Context: IT administrators frequently deploy endpoint management agents such as Microsoft Intune, Jamf Pro, or Ivanti Neurons. These tools often install background services that match the Mozi IOCs, particularly if the vendor uses a common library (e.g., a specific version of a .NET runtime or a logging daemon) that shares an IOC with the Mozi malware.
  • Suggested Filter/Exclusion: Create an exclusion for Process Name containing keywords like “IntuneManagementExtension”, “JamfAgent”, or “IvantiService”. Furthermore, filter alerts where the User Account is a known service account (e.g., DOMAIN\svc-deployment) rather than