This hunt hypothesis detects adversary activity by correlating known Aisuru threat indicators to identify potential compromises within the Azure Sentinel environment. Proactively hunting for these specific IOCs is critical because early detection of this high-severity threat enables rapid containment and prevents lateral movement before broader organizational impact occurs.
Malware Family: Aisuru Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 91[.]108[.]249[.]56:8443 | botnet_cc | 2026-08-14 | 100% |
| ip:port | 89[.]19[.]223[.]68:9034 | botnet_cc | 2026-08-14 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["91.108.249.56", "89.19.223.68"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["91.108.249.56", "89.19.223.68"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: Aisuru IOCs detection rule, along with targeted filtering strategies:
Scenario: The corporate Endpoint Detection and Response (EDR) solution (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) performs a scheduled daily definition update. During this process, the EDR agent downloads signature files from an Aisuru-managed repository, triggering network traffic to known Aisuru IP addresses that match the rule’s IOCs.
Process Name of the EDR updater (e.g., MsMpEng.exe or FalconSensorService) when the destination port is standard HTTPS (443) and the source subnet matches the internal management VLAN.Scenario: A scheduled PowerShell job runs nightly to back up configuration files from the on-premise Active Directory environment to an external cloud storage provider that utilizes Aisuru’s threat intelligence feeds for scanning. The backup agent establishes a connection to the Aisuru API endpoint, generating logs that match the IOCs.
User Account is a dedicated service account (e.g., svc-backup-agent) and the Process Command Line contains specific keywords like “Backup” or “Sync,” provided the connection duration exceeds 5 minutes.Scenario: The IT Security team manually deploys a new threat intelligence feed via the ThreatFox console, which involves the internal SIEM (e.g., Splunk or Sentinel) pulling IOC data directly from Aisuru’s public API to enrich current alerts. This administrative pull generates network sessions that trigger the detection rule.