ThreatFox: Aisuru IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific Indicators of Compromise (IOCs) linked to the Aisuru threat actor, which may signal early-stage reconnaissance or lateral movement within the network. The SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly identify and contain potential intrusions before they escalate into significant security incidents.

IOC Summary

Malware Family: Aisuru Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["167.99.64.180", "139.59.144.8"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["167.99.64.180", "139.59.144.8"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Aisuru

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Aisuru IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Enterprise Antivirus Definition Updates

  • Context: The organization utilizes Microsoft Defender for Endpoint or CrowdStrike Falcon. During scheduled definition updates (typically nightly), the AV engine downloads signature databases from a vendor repository that shares an IP address or domain with the Aisuru threat intelligence feed. This triggers the rule when the AV service connects to fetch updates, mimicking the IOCs associated with Aisuru.
  • Filter/Exclusion: Create a whitelist exclusion for the specific process names MsMpEng.exe (Microsoft) and falcon.sys (CrowdStrike). Additionally, exclude network traffic originating from these processes if the destination IP matches the known vendor update server range (e.g., 13.107.x.x for Microsoft or 44.238.x.x for CrowdStrike) rather than the specific Aisuru IOC list.

• Scenario: Scheduled Backup and Archiving Jobs

  • Context: The enterprise runs nightly backup jobs using Veeam Backup & Replication or Rubrik. These tools often utilize a central management server that communicates with external cloud storage providers or reporting dashboards. If the Aisuru IOCs include a domain used by these vendors for telemetry or status reporting, the scheduled job execution will generate alerts every night at 02:00 AM.
  • Filter/Exclusion: Implement a time-based exclusion window (e.g., 01:30 – 04:00) specifically for the backup service accounts (e.g., VeeamService or RubrikAgent). Alternatively, filter out alerts where the source process is identified as `vbr.exe