ThreatFox: Mozi IOCs

Hunt Hypothesis

This detection rule identifies adversary activity by correlating known Mozi malware indicators of compromise (IOCs) within network and endpoint logs to uncover potential infections or lateral movement. A proactive hunt is essential in Azure Sentinel to rapidly isolate compromised assets before the threat actor can establish persistence or exfiltrate sensitive data, given the high severity associated with Mozi’s advanced capabilities.

IOC Summary

Malware Family: Mozi Total IOCs: 3 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://27.215.139.11:38006/Mozi.m", "http://153.117.1.177:55591/Mozi.m", "http://103.176.16.65:50528/Mozi.a"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

False Positive Scenarios for “ThreatFox: Mozi IOCs” Rule

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise endpoint protection suites like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint often perform automated definition updates during off-hours. These updates may download and execute signature files that contain hash values matching Mozi’s known IOCs, triggering the rule even though the activity is a routine maintenance task.
  • Suggested Filter/Exclusion: Create an exclusion based on the Process Name of the update service (e.g., falcon.sys, SentinelOne.exe) and restrict the alert to only trigger if the process command line does not contain keywords like “update,” “definition,” or “scan.” Alternatively, exclude the specific source IP addresses of the vendor’s update servers.

• Scenario: Admin-Driven Software Deployment via Configuration Management

  • Context: IT administrators frequently use tools such as Microsoft SCCM (Configuration Manager), Ivanti, or Ansible to deploy new software packages across the fleet. If a deployed application package includes a component that matches Mozi’s IOCs, the deployment agent executing the installation will trigger the detection logic during the rollout window.
  • Suggested Filter/Exclusion: Implement a filter that excludes alerts where the Parent Process is a known configuration management tool (e.g., ccmsetup.exe, IvantiAgent.exe) or where the user context is a dedicated service account (e.g., DOMAIN\DeploySvc). Additionally, correlate with Change Management tickets to suppress alerts during active deployment windows.

• Scenario: Third-Party Security Tool Integration and Telemetry

  • Context: In environments utilizing multiple security layers, tools like Splunk, Elastic SIEM, or **Qualys