ThreatFox: Aisuru IOCs

Hunt Hypothesis

This detection identifies Aisuru malware activity by monitoring encrypted command-and-control communications and data exfiltration attempts originating from identified IP:port pairs associated with phishing or exploit kit infections. Proactively hunting for these indicators in Azure Sentinel is critical to rapidly detect early-stage intrusions that leverage encrypted channels to bypass traditional network security controls, thereby preventing sensitive data loss before the adversary establishes a persistent foothold.

IOC Summary

Malware Family: Aisuru Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["137.184.135.42", "149.28.128.253"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["137.184.135.42", "149.28.128.253"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Aisuru

False Positive Guidance

False Positive Scenarios: ThreatFox: Aisuru IOCs Detection Rule

• Scenario 1: Scheduled Cloud Backup Agent Communication

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik often establish encrypted outbound connections to cloud storage gateways (e.g., AWS S3, Azure Blob) on specific ports that may overlap with Aisuru C2 patterns. If the backup agent’s destination IP matches a known Aisuru IOC, the rule triggers during nightly scheduled jobs.
  • Suggested Filter/Exclusion: Create an exclusion based on the Process Name (VeeamTransport.exe or rubrik-agent) and User Account (e.g., DOMAIN\BackupSvc). Additionally, whitelist the specific destination IP range of the cloud provider if it aligns with the detection logic.

• Scenario 2: Patch Management System Updates

  • Context: Automated patching tools such as Microsoft Endpoint Configuration Manager (SCCM) or Ivanti Neurons frequently initiate outbound HTTPS connections to vendor update repositories (e.g., www.microsoft.com, updates.ivanti.com). These systems often use standard encrypted ports (443) and may connect to IP addresses that share characteristics with the Aisuru family’s C2 infrastructure.
  • Suggested Filter/Exclusion: Implement a filter excluding traffic where the Source Process is identified as ccmexec.exe or ivanti-agent.exe. You can also add an exclusion for specific Destination Domains associated with known patching vendors to prevent noise during maintenance windows.

• Scenario 3: Third-Party SaaS Analytics and Telemetry

  • Context: Legitimate business intelligence tools like Tableau Server, Power BI Gateway, or Splunk Universal Forwarder periodically send telemetry