ThreatFox: Aisuru IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies the presence of Aisuru malware by monitoring for encrypted command-and-control communications and data exfiltration patterns directed at specific IP:port pairs associated with known threat indicators. Proactive hunting for these behaviors in Azure Sentinel is critical to rapidly isolate compromised assets before sensitive data is fully extracted, given the malware’s ability to maintain covert operations through standard network traffic channels.

IOC Summary

Malware Family: Aisuru Total IOCs: 3 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`162[.]243[.]240[.]81:8443`	botnet_cc	2026-08-13	100%
ip:port	`38[.]207[.]178[.]195:12345`	botnet_cc	2026-08-13	100%
ip:port	`198[.]211[.]96[.]18:8443`	botnet_cc	2026-08-13	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["38.207.178.195", "198.211.96.18", "162.243.240.81"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["38.207.178.195", "198.211.96.18", "162.243.240.81"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Aisuru

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Aisuru IOCs detection rule in an enterprise environment, along with targeted filtering strategies:

Scenario: Cloud Backup Agent Heartbeats
- Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik frequently establish persistent encrypted connections to their cloud management portals (SaaS) for status reporting and policy synchronization. These agents often communicate with specific IP ranges that may overlap with the Aisuru C2 indicators, particularly on ports 443 or custom high-numbered ports used by the backup vendor.
- Filter/Exclusion: Create an exclusion rule based on the Source Host and Destination Service Name. Exclude traffic where the source process is identified as vbr.exe (Veeam) or rubrik-agent.exe, regardless of the destination IP, provided the connection duration exceeds 5 minutes (indicating a long-lived session rather than a bursty C2 beacon).
Scenario: Scheduled Software Update Deployments
- Context: Managed IT environments often utilize tools like Microsoft Endpoint Configuration Manager (SCCM) or Jamf Pro to push updates. During scheduled maintenance windows, these agents connect to specific update servers or content libraries using encrypted channels. If the Aisuru rule targets a port commonly used by these vendors (e.g., 443, 8080), legitimate update traffic can trigger alerts due to matching IP:port pairs.
- Filter/Exclusion: Implement a time-based exclusion or process-specific filter. Exclude events where the Process Name is ccmexec.exe (SCCM) or jamf.bin, and restrict the alert window to exclude known maintenance windows (e.g., 02:00–04:00 UTC daily).