ThreatFox: Aisuru IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity by correlating network and endpoint logs against five specific Indicators of Compromise (IOCs) linked to the Aisuru threat actor. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification of Aisuru’s unique signatures allows the SOC team to isolate compromised assets before lateral movement or data exfiltration occurs.

IOC Summary

Malware Family: Aisuru Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`198[.]211[.]96[.]18:8001`	botnet_cc	2026-08-12	100%
ip:port	`162[.]243[.]240[.]81:8001`	botnet_cc	2026-08-12	100%
ip:port	`68[.]183[.]221[.]133:8001`	botnet_cc	2026-08-12	100%
ip:port	`89[.]19[.]223[.]68:8443`	botnet_cc	2026-08-12	100%
ip:port	`165[.]22[.]81[.]15:8001`	botnet_cc	2026-08-12	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["162.243.240.81", "89.19.223.68", "165.22.81.15", "68.183.221.133", "198.211.96.18"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["162.243.240.81", "89.19.223.68", "165.22.81.15", "68.183.221.133", "198.211.96.18"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Aisuru

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Aisuru IOCs detection rule, including tailored filters and exclusions suitable for an enterprise environment:

Scenario: Security Tool Integration Scans
- Context: Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon or Microsoft Defender for Endpoint periodically query the ThreatFox API to update their local threat intelligence feeds. This process generates network traffic matching Aisuru IOCs as part of a routine synchronization task, not an active compromise.
- Filter/Exclusion: Exclude alerts where the source process is FalconSensor.exe (CrowdStrike) or MsMpEng.exe (Defender) and the destination port corresponds to the ThreatFox API endpoint (e.g., Port 443). Add a filter: ProcessName IN ('FalconSensor.exe', 'MsMpEng.exe') AND DestinationPort == 443.
Scenario: Scheduled Vulnerability Management Jobs
- Context: Automated vulnerability scanners, such as Tenable Nessus or Qualys, run nightly jobs to validate asset inventory against known threat indicators. These scanners often download IOC lists from ThreatFox repositories, triggering the rule when they fetch Aisuru-specific signatures during their scheduled maintenance window (e.g., 02:00 – 04:00 UTC).
- Filter/Exclusion: Create a time-based exclusion for the specific scanner service accounts. Filter logic: SourceUser IN ('svc-nessus', 'svc-qualys') AND TimeOfDay BETWEEN 02:00 AND 04:00. Alternatively, whitelist the IP addresses of the internal vulnerability management servers in the ThreatFox rule configuration.
Scenario: Admin Manual Threat Intelligence Updates
- Context: Security Operations Center (