ThreatFox: Mozi IOCs

Hunt Hypothesis

This hunt targets adversary behavior consistent with the Mozi threat actor by actively searching for nine specific indicators of compromise across network and endpoint logs within Azure Sentinel. Proactively hunting for these IOCs is critical to detect early-stage reconnaissance or lateral movement activities before they escalate into a full-blown incident, ensuring rapid containment in the cloud environment.

IOC Summary

Malware Family: Mozi Total IOCs: 9 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mozi
let malicious_urls = dynamic(["http://188.169.20.12:35057/Mozi.a", "http://172.168.137.58:37141/Mozi.m", "http://5.166.134.69:43702/Mozi.m", "http://223.123.43.71:35524/Mozi.m", "http://119.157.76.175:39761/Mozi.m", "http://101.53.225.41:45308/Mozi.m", "http://112.246.97.119:37502/Mozi.m", "http://153.117.15.75:41179/Mozi.a", "http://175.107.228.60:46088/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mozi

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Mozi IOCs detection rule in an enterprise environment, along with recommended filters or exclusions:

• Antivirus Definition Updates via Windows Update

  • Scenario: The scheduled task WindowsUpdate or a third-party AV management console (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) downloads and executes the latest threat intelligence feed. If Mozi IOCs include specific hash values of common update manifests or installer executables used by these vendors, the detection will trigger during routine patching windows.
  • Filter/Exclusion: Exclude events where the Parent_Process_Name is UpdateOrchestrator.exe (Windows Update) or CfSvc.exe (CrowdStrike), and restrict the rule to only alert on processes originating from non-standard user directories (e.g., exclude paths starting with C:\Program Files\Microsoft Defender).

• Enterprise Software Deployment via SCCM/Intune

  • Scenario: The IT Operations team deploys a new application or patches existing software using Microsoft Endpoint Configuration Manager (SCCM) or Intune. The deployment agent (ccmexec.exe or Microsoft.IntuneManagementExtension) may download and execute installers that contain Mozi-associated libraries or scripts, particularly if the organization uses shared internal repositories hosting these files.
  • Filter/Exclusion: Create an exclusion for processes with a Parent_Process_Name of ccmexec.exe or IntuneManagementExtension.exe. Additionally, filter out events where the User_Account is a service account (e.g., DOMAIN\SCCM_Service_Acct) rather than an interactive user.

• Scheduled Backup and Archiving Jobs

  • Scenario: Enterprise backup solutions like Veeam Backup & Replication or Commvault run scheduled jobs that scan, compress