ThreatFox: Aisuru IOCs

Hunt Hypothesis

This hunt detects adversary activity by correlating network and endpoint logs against three specific Indicators of Compromise (IOCs) linked to the Aisuru threat actor. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification of this high-severity campaign enables rapid containment before lateral movement or data exfiltration occurs within the environment.

IOC Summary

Malware Family: Aisuru Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["46.16.34.50", "85.120.81.167", "143.198.206.191"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["46.16.34.50", "85.120.81.167", "143.198.206.191"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Aisuru

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Aisuru IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Security Tool Self-Scanning

  • Context: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled daily scan of the C:\Program Files\ directory. During this process, the scanner extracts and analyzes a known Aisuru signature file used as a benchmark dataset within its own repository, triggering the IOC match.
  • Filter/Exclusion: Create an exclusion rule in the EDR console to ignore network connections or process executions originating from the CrowdStrike Falcon Sensor (or specific Defender service PID) when accessing files located in the C:\Program Files\ThreatIntel\Benchmarks\ directory.

• Scenario: Scheduled Threat Intelligence Ingestion Job

  • Context: A nightly PowerShell script runs via Task Scheduler to ingest new threat intelligence feeds from an internal repository (e.g., a local Azure Blob Storage or S3 bucket). This job downloads the latest “Aisuru” IOC package JSON file for enrichment, causing the detection engine to flag the download activity as a potential compromise.
  • Filter/Exclusion: Exclude the specific scheduled task name ThreatIntel_Ingest_Job (or the associated PowerShell process ID) from triggering this rule when the source IP is the internal jump host or the ingestion server’s static IP range (e.g., 10.20.50.x).

• Scenario: Admin Remediation of Legacy Software

  • Context: An IT administrator manually installs a legacy business application that includes an Aisuru-based component for compliance reporting. During installation, the installer extracts and registers several DLLs associated with the Aisuru framework,