ThreatFox: Aisuru IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific Indicators of Compromise (IOCs) linked to the Aisuru threat actor, which may signal early-stage reconnaissance or lateral movement within the network. Proactively hunting for these IOCs in Azure Sentinel is critical because Aisuru’s high-severity indicators often precede significant data exfiltration events that require immediate containment before they escalate into broader breaches.

IOC Summary

Malware Family: Aisuru Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["161.35.48.40", "38.207.178.195"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["161.35.48.40", "38.207.178.195"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Aisuru

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Aisuru IOCs detection rule, along with suggested filters and exclusions tailored for a legitimate enterprise environment:

• Endpoint Protection Vendor Updates (CrowdStrike/SentinelOne)

  • Scenario: The Aisuru IOC list includes hash signatures or domain patterns that overlap with the update servers of major EDR vendors. When the CrowdStrike Falcon sensor or SentinelOne agent performs its nightly signature database refresh, it may trigger a connection to an IP address or download a file matching an Aisuru IOC, generating a hit despite being benign traffic from a trusted vendor.
  • Filter/Exclusion: Create a detection exclusion based on the Process Name (e.g., C:\Program Files\CrowdStrike\fs_qc.exe) and restrict the rule to exclude events where the Parent Process is the EDR service itself. Alternatively, add the specific update server domains of your EDR provider to the “Trusted Domains” allow-list within the ThreatFox integration settings.

• Scheduled Enterprise Backup Jobs (Veeam/Commvault)

  • Scenario: Aisuru IOCs often include file hashes associated with common utility tools or compressed archives used in backup routines. During peak backup windows, Veeam Backup & Replication or Commvault agents may generate temporary staging files or connect to cloud storage endpoints that match the Aisuru hash or network indicators, causing a false alert on the backup server’s activity.
  • Filter/Exclusion: Implement a time-based exclusion for the rule during known maintenance windows (e.g., 02:00–04:00 UTC). Additionally, filter out events where the User Account is a dedicated service account (e.g., svc_backup_admin) and the Process Path contains keywords like \Veeam\ or