ThreatFox: Aisuru IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the Aisuru threat actor by correlating network and endpoint telemetry against a specific set of 14 Indicators of Compromise (IOCs). Proactively hunting for these signatures in Azure Sentinel is critical because early identification of Aisuru’s unique infrastructure allows the SOC team to isolate potential compromises before they escalate into significant data exfiltration or lateral movement incidents.

IOC Summary

Malware Family: Aisuru Total IOCs: 14 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["164.92.179.21", "165.232.71.140", "164.37.109.234", "159.65.61.151", "139.59.161.246", "178.128.208.65", "159.89.132.240", "138.68.138.44", "138.68.93.46"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["164.92.179.21", "165.232.71.140", "164.37.109.234", "159.65.61.151", "139.59.161.246", "178.128.208.65", "159.89.132.240", "138.68.138.44", "138.68.93.46"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Aisuru

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Aisuru IOCs detection rule, tailored for an enterprise environment:

• Authorized Endpoint Protection Updates

  • Scenario: The organization’s central management console (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) pushes a scheduled definition update that includes the aisuru telemetry module. This triggers network traffic to Aisuru command-and-control (C2) domains and file creation events matching the IOCs during the standard 03:00 UTC maintenance window across all workstations.
  • Filter/Exclusion: Create a suppression rule excluding alerts where the Process Name is CrowdStrike Falcon Sensor.exe or MsMpEng.exe, AND the Source IP belongs to the internal update server subnet (e.g., 10.20.50.0/24).

• Security Research & Threat Intelligence Enrichment Jobs

  • Scenario: The SOC team runs a weekly automated job using Splunk SOAR or Tenable.io to ingest and validate new threat intelligence feeds. This job explicitly queries Aisuru’s public API endpoints to cross-reference internal logs against the latest Aisuru malware signatures, generating legitimate HTTP/HTTPS connections to the specific IOCs defined in the rule.
  • Filter/Exclusion: Exclude alerts originating from the Security Automation service account (e.g., svc_threat_intel) where the destination port is 443 and the user agent string contains “Tenable” or “Splunk SOAR”.

• Third-Party Backup Agent Connectivity

  • Scenario: The enterprise utilizes a cloud-based backup solution (e.g., Veeam Backup & Replication or Commvault) that integrates with Aisuru for real-time malware