ThreatFox: Aisuru IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity by correlating seven specific Indicators of Compromise (IOCs) linked to the Aisuru threat actor across Azure Sentinel logs. Proactively hunting for these IOCs is critical because early identification of this high-severity campaign enables the SOC team to isolate affected assets before lateral movement or data exfiltration occurs.

IOC Summary

Malware Family: Aisuru Total IOCs: 7 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`167[.]99[.]64[.]180:8001`	botnet_cc	2026-07-31	100%
ip:port	`206[.]189[.]81[.]41:8001`	botnet_cc	2026-07-31	100%
ip:port	`143[.]198[.]206[.]191:8001`	botnet_cc	2026-07-31	100%
ip:port	`137[.]184[.]70[.]190:8443`	botnet_cc	2026-07-31	100%
ip:port	`137[.]184[.]199[.]120:8001`	botnet_cc	2026-07-31	100%
ip:port	`167[.]172[.]71[.]69:8001`	botnet_cc	2026-07-31	100%
ip:port	`47[.]107[.]224[.]89:8443`	botnet_cc	2026-07-31	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["143.198.206.191", "167.99.64.180", "47.107.224.89", "137.184.199.120", "206.189.81.41", "167.172.71.69", "137.184.70.190"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["143.198.206.191", "167.99.64.180", "47.107.224.89", "137.184.199.120", "206.189.81.41", "167.172.71.69", "137.184.70.190"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Aisuru

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Aisuru IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Scheduled Endpoint Protection Scans by Admin Accounts
- Context: The Aisuru detection logic flags connections to specific IP ranges or hash values often used by security vendors. In many enterprises, the Microsoft Defender for Endpoint (or similar tools like CrowdStrike) performs scheduled daily scans or policy updates from these exact IOCs under a dedicated service account (e.g., svc_antivirus or DOMAIN\AdminScan).
- Filter/Exclusion: Create an exclusion rule that suppresses alerts where the source user is a known Service Account (identified by User.Type = 'Service') and the process name matches MsMpEng.exe, DefenderSvc.exe, or CrowdStrike.exe. Additionally, exclude traffic occurring during the defined maintenance window (e.g., 02:00–04:00 UTC).
Scenario: Legitimate Cloud Backup and Synchronization Jobs
- Context: Aisuru IOCs often overlap with cloud storage providers used for enterprise backups. Tools like Veeam Backup & Replication, Rubrik, or Microsoft OneDrive for Business may initiate connections to the same external IP addresses or download specific update packages that match the Aisuru hash signatures during their nightly sync cycles.
- Filter/Exclusion: Implement a filter excluding events where the destination port is 443 (HTTPS) and the process name belongs to known backup utilities (vbr.exe, rubrik-agent.exe, or OneDrive.exe). Furthermore, exclude alerts generated by hosts tagged with “Backup Server” in your CMDB.
Scenario: Software Deployment via Configuration Management Tools
- **Context