ThreatFox: Aisuru IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific Indicators of Compromise (IOCs) linked to the Aisuru threat actor, which are known to target cloud and enterprise environments. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification allows the SOC team to isolate compromised assets before the attacker establishes persistence or exfiltrates sensitive data.

IOC Summary

Malware Family: Aisuru Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["206.189.81.41", "161.35.48.40"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["206.189.81.41", "161.35.48.40"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Aisuru

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Aisuru IOCs detection rule in an enterprise environment:

• Scenario: Security Team Manual Threat Intelligence Testing

  • Context: The SOC team regularly imports new threat intelligence feeds or manually tests the “Aisuru” IOC package within their SIEM (e.g., Splunk, Sentinel) to verify ingestion pipelines. This involves running a test query that explicitly matches Aisuru hashes against a sandbox environment, triggering the rule even though no malicious activity exists on production endpoints.
  • Suggested Filter: Exclude events where the source_host or source_ip belongs to the dedicated “SOC-Testing” subnet (e.g., 10.20.x.x) and the event type is marked as "TestRun" or "ManualQuery".

• Scenario: Scheduled Antivirus Definition Updates via Intune

  • Context: The enterprise utilizes Microsoft Intune to push updated definition packs from a specific vendor that includes Aisuru signatures. During the nightly maintenance window (e.g., 02:00–04:00), the Antimalware service on thousands of endpoints scans and downloads these definitions, generating logs that match the Aisuru IOCs as part of the update process rather than a live threat detection.
  • Suggested Filter: Create an exclusion for events occurring between 02:00 and 04:00 UTC where the process_name is "MsMpEng.exe" (Windows Defender) or "IntuneAgent.exe" and the action_type is "DefinitionUpdate".

• Scenario: Endpoint Detection and Response (EDR) Baseline Scans

  • Context: The organization runs a weekly full-system integrity scan using CrowdStrike Falcon. This scheduled job scans all installed software binaries