ThreatFox: Aisuru IOCs

Hunt Hypothesis

This detection rule identifies adversary activity by correlating network and endpoint telemetry against nine specific Indicators of Compromise (IOCs) linked to the Aisuru threat actor. Proactive hunting for these IOCs in Azure Sentinel is critical because early identification of this high-severity campaign enables rapid containment before the adversary can establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: Aisuru Total IOCs: 9 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["207.154.240.223", "206.189.81.41", "89.19.223.68", "143.198.206.191", "167.172.71.69", "103.214.146.46", "137.184.199.120"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["207.154.240.223", "206.189.81.41", "89.19.223.68", "143.198.206.191", "167.172.71.69", "103.214.146.46", "137.184.199.120"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Aisuru
let malicious_domains = dynamic(["kieronellisonhikslumberparty.ru"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Aisuru

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Aisuru IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

• Endpoint Protection Policy Updates via Microsoft Defender for Endpoint

  • Scenario: The organization’s automated “Antivirus Definition Update” scheduled task (running nightly at 02:00 AM) downloads new signature definitions from a vendor repository that shares the same IP range or hash as an Aisuru IOC. This triggers the rule when the update service connects to the cloud endpoint.
  • Filter/Exclusion: Exclude traffic originating from the specific Microsoft Defender Antivirus Service (Process Name: MsMpEng.exe) where the destination port is 443 and the source user context is SYSTEM. Alternatively, add the known vendor update server IP to a “Trusted External IPs” allowlist.

• Software Deployment via Microsoft SCCM/Intune

  • Scenario: A scheduled deployment job for a third-party application (e.g., Adobe Acrobat or Zoom) utilizes an installer package that includes a telemetry beacon matching an Aisuru domain. When the Configuration Manager client (ccmexec.exe) pulls the payload from the distribution point, it generates a network connection flagged by the rule.
  • Filter/Exclusion: Create a detection exclusion for process ccmexec.exe (System Center Configuration Manager) when the destination domain matches the specific Aisuru IOC URL associated with software telemetry. Ensure the exclusion applies only during the defined maintenance window (e.g., 01:00–05:00).

• Cloud Backup Synchronization (Veeam or Rubrik)

  • Scenario: The enterprise backup solution initiates a nightly synchronization job to an offsite cloud repository. The backup agent (vrb.exe for Veeam) establishes a