ThreatFox: Aisuru IOCs

Hunt Hypothesis

This hypothesis targets the presence of known Aisuru IOCs to identify potential compromise by this advanced threat actor, which often leverages stealthy techniques for initial access and lateral movement. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect early-stage intrusion attempts and isolate affected assets before the adversary can establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: Aisuru Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["188.166.246.245", "134.122.126.123"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["188.166.246.245", "134.122.126.123"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Aisuru

False Positive Guidance

• Scenario: Automated Patch Management via SCCM/WSUS

  • Context: System Center Configuration Manager (SCCM) or Windows Update Services (WSUS) agents frequently execute wuaex.dll or wuauclt.exe to check for updates, which may involve network connections to specific Microsoft endpoints or internal distribution points that overlap with Aisuru’s known C2 or staging infrastructure.
  • Filter/Exclusion: Exclude alerts where the source process is wuauclt.exe, wuaex.dll, or ccmexec.exe and the destination IP is within the internal Microsoft Update distribution subnet (e.g., 10.20.30.0/24).

• Scenario: Enterprise Backup Agents (Veeam/Commvault)

  • Context: Backup agents like VeeamBackup.exe or commagent.exe often establish persistent TCP connections to backup servers for data transfer. If the backup server’s IP address coincidentally matches one of the Aisuru IOCs (often public IPs used for cloud backup gateways), this triggers the rule.
  • Filter/Exclusion: Exclude alerts where the source process name matches VeeamBackup.exe, commagent.exe, or npp.exe (NetBackup) and the destination port is a standard backup port (e.g., 47001, 8443, or 10000).

• Scenario: Log Collection Agents (Splunk/Sumo Logic)

  • Context: Log forwarders such as splunkd.exe or sumoagent.exe send telemetry data over HTTPS to centralized logging platforms. If the logging platform’s public endpoint IP is listed in the Aisuru IOC set (common for shared cloud services), the agent’s outbound connection triggers the alert.