ThreatFox: Aisuru IOCs

Hunt Hypothesis

This hunt hypothesis targets adversaries deploying Aisuru malware to establish covert backdoors for data exfiltration and command execution following initial compromise via phishing or credential theft. Proactively hunting for these specific IP:port IOCs in Azure Sentinel is critical to detect early-stage persistence mechanisms before attackers can fully entrench their presence within the network.

IOC Summary

Malware Family: Aisuru Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["168.144.135.136"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["168.144.135.136"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Aisuru

False Positive Guidance

False Positive Scenarios for “ThreatFox: Aisuru IOCs” Rule

• Scenario 1: Scheduled Backup Agent Communication

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault often initiate daily scheduled jobs to connect to remote storage repositories. If the backup server’s IP address and port (e.g., TCP 9402 or 8500) match the Aisuru IOCs, the rule triggers because these agents establish persistent network connections for data exfiltration similar to the malware’s behavior.
  • Filter/Exclusion: Create an exclusion based on the specific Source Hostname (e.g., backup-srv-01) and the Process Name (vbr.exe or cvpserver.exe). Additionally, exclude traffic where the destination IP belongs to the internal backup subnet range.

• Scenario 2: Microsoft Defender for Endpoint Cloud Connectivity

  • Context: The Microsoft Defender for Endpoint (MDE) agent continuously communicates with the cloud service for policy updates, telemetry upload, and threat intelligence synchronization. This traffic often utilizes standard HTTPS ports or specific proprietary ports that may overlap with Aisuru’s initial connection patterns, causing false alerts during routine health checks.
  • Filter/Exclusion: Exclude network flows where the Process Path contains \Program Files\Microsoft Defender\MsMpEng.exe and the destination domain matches *.microsoft.com. Alternatively, whitelist the specific User Account (e.g., SYSTEM) running these processes during off-hours.

• Scenario 3: Patch Management Deployment via SCCM/Intune

  • Context: During scheduled maintenance windows, tools like Microsoft Endpoint Configuration Manager (SCCM) or Intune push updates to endpoints. These agents establish covert connections to download payloads and execute