ThreatFox: Aisuru IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity by correlating network and endpoint telemetry against nine specific Indicators of Compromise (IOCs) linked to the Aisuru threat actor, enabling the identification of known malicious artifacts within the environment. The SOC team should proactively hunt for these IOCs in Azure Sentinel because early detection of this high-severity campaign allows for rapid containment of potential lateral movement and data exfiltration before the adversary can establish a persistent foothold.

IOC Summary

Malware Family: Aisuru Total IOCs: 9 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`137[.]184[.]199[.]120:8443`	botnet_cc	2026-08-03	100%
ip:port	`103[.]214[.]146[.]46:12345`	botnet_cc	2026-08-03	100%
ip:port	`168[.]144[.]138[.]186:12345`	botnet_cc	2026-08-03	100%
ip:port	`144[.]124[.]239[.]18:34567`	botnet_cc	2026-08-03	100%
ip:port	`198[.]98[.]53[.]100:34567`	botnet_cc	2026-08-03	100%
ip:port	`165[.]245[.]219[.]184:8443`	botnet_cc	2026-08-03	100%
ip:port	`207[.]154[.]240[.]223:9034`	botnet_cc	2026-08-03	100%
ip:port	`198[.]98[.]53[.]100:9035`	botnet_cc	2026-08-03	100%
ip:port	`47[.]107[.]224[.]89:9034`	botnet_cc	2026-08-03	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["144.124.239.18", "137.184.199.120", "47.107.224.89", "168.144.138.186", "165.245.219.184", "198.98.53.100", "103.214.146.46", "207.154.240.223"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["144.124.239.18", "137.184.199.120", "47.107.224.89", "168.144.138.186", "165.245.219.184", "198.98.53.100", "103.214.146.46", "207.154.240.223"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Aisuru

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Aisuru IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

Scenario: Security Tool Telemetry Ingestion
- Context: The organization’s Endpoint Detection and Response (EDR) or SIEM platform (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) periodically pulls threat intelligence feeds from ThreatFox. This process involves the security agent downloading IOC lists containing Aisuru signatures to update local detection engines, triggering alerts when the feed is parsed.
- Filter/Exclusion: Exclude processes originating from the specific EDR service account (e.g., CRFalconSvc or MsMpEng) and restrict the scope to the security management server’s IP range. Add a filter: ProcessName IN ('C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe', 'C:\Windows\System32\MsMpEng.exe') AND SourceIP IN (SecurityServerSubnet).
Scenario: Scheduled Threat Intelligence Feed Update
- Context: A nightly scheduled task runs on the central threat intelligence server to synchronize external feeds. This job uses a script (e.g., PowerShell or Python via pscheduler) to fetch and parse JSON/XML data from ThreatFox, which inherently contains the Aisuru IOCs being hunted by this rule.
- Filter/Exclusion: Create an exclusion based on the specific scheduled task name and execution time window. Filter: EventID = 201 AND TaskName = 'ThreatIntelSync' AND StartTime BETWEEN (00:00, 06:00). Alternatively, whitelist the service account running this job (e.g., DOMAIN\svc-threatintel).
Scenario: Admin Manual Threat Hunt Investigation
- **Context