ThreatFox: Mozi IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Mozi threat actor by monitoring specific Indicators of Compromise (IOCs) known to be utilized in their campaigns. A proactive hunt is essential within Azure Sentinel to rapidly detect and isolate early-stage intrusions from this sophisticated group, thereby minimizing potential data exfiltration or lateral movement before broader impact occurs.

IOC Summary

Malware Family: Mozi Total IOCs: 2 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://72.255.19.251:56706/Mozi.m", "http://175.107.36.125:37662/Mozi.a"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

False Positive Scenarios for “ThreatFox: Mozi IOCs” Rule

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise AV solutions like CrowdStrike Falcon or Microsoft Defender for Endpoint frequently download definition updates from the vendor’s cloud repository. The Mozi detection logic may flag the specific hash of a new update package or the associated certificate as a known Mozi IOC, triggering an alert during nightly maintenance windows (e.g., 2:00 AM).
  • Suggested Filter: Create an exclusion for processes named C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe and C:\ProgramData\Microsoft\Windows Defender\Platform\mpcmdrun.exe when the source IP belongs to the vendor’s CDN range (e.g., CrowdStrike or Microsoft Azure ranges) during defined maintenance hours.

• Scenario: Third-Party Patch Management Deployment

  • Context: Automated patching tools such as Ivanti Neurons or ManageEngine Endpoint Central often execute scripts that download and install security patches from vendor repositories. If the Mozi IOCs include a specific installer executable hash used by these vendors, legitimate patch deployments across 50+ workstations will generate high-volume false positives.
  • Suggested Filter: Exclude alerts where the parent process is IvantiAgent.exe or ManageEngineEndpointCentralService.exe and the event occurs within the “Patch Tuesday” window (e.g., every second Tuesday between 18:00 and 22:00).

• Scenario: Cloud Backup Agent Communication

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik utilize agents that periodically communicate with cloud storage gateways. These agents often establish connections to external IP addresses for metadata synchronization, which