ThreatFox: Mozi IOCs

Hunt Hypothesis

This hunt hypothesis targets the Mozi malware family’s behavior of establishing command-and-control channels and exfiltrating sensitive data following initial compromise through phishing-delivered malicious URLs. A SOC team should proactively hunt for these indicators in Azure Sentinel to detect early-stage lateral movement driven by stolen credentials, thereby preventing widespread network infiltration before significant data loss occurs.

IOC Summary

Malware Family: Mozi Total IOCs: 2 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://61.53.8.56:50916/Mozi.m", "http://139.135.46.28:55160/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Mozi IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Enterprise Phishing Simulation Campaigns

  • Context: Security teams frequently run internal phishing simulations (e.g., using KnowBe4, Proofpoint, or Coveware) that mimic the Mozi attack vector. These campaigns often send emails containing URLs that redirect to external landing pages hosted on cloud platforms (like Azure AD B2C or AWS S3) which may share IP ranges or domain patterns with known Mozi C2 infrastructure.
  • Filter/Exclusion: Exclude traffic originating from the internal “Phishing Simulation” IP range or specific simulation domains (e.g., *.phishlabs.com, *.knowbe4.net) where the user agent indicates a browser session rather than a script execution. Additionally, filter out events where the HTTP referrer is an internal mail gateway (e.g., Office 365 Exchange Online Protection) and the destination URL contains standard simulation query parameters.

• Scenario: Scheduled Backup and Data Exfiltration Jobs

  • Context: Mozi is known for data exfiltration, which overlaps significantly with legitimate backup workflows. Automated jobs running via Veeam, Rubrik, or Azure Backup Agent often establish persistent C2-like connections to cloud storage buckets (e.g., AWS S3, Azure Blob) using stolen credentials or service accounts that match the behavioral profile of Mozi lateral movement.
  • Filter/Exclusion: Create an exclusion based on the source process name and user context. Filter out events where the Process Name is vrb.exe (Veeam), rubrik-agent.exe, or azcopy.exe, AND the User Account belongs to a