ThreatFox: Aisuru IOCs

Hunt Hypothesis

This hunt targets known indicators of compromise associated with the Aisuru threat actor to identify potential lateral movement or persistence mechanisms within the environment. Proactively hunting for these specific IOCs allows the SOC to detect early-stage intrusions and mitigate the risk of high-severity threats before they escalate into broader compromise.

IOC Summary

Malware Family: Aisuru Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["43.157.63.92"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["43.157.63.92"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Aisuru

False Positive Guidance

• Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., GitHub Actions or Jenkins) to deploy a new microservice that includes a shared library or configuration file matching one of the Aisuru IOCs (e.g., a specific hash or IP address) as part of a standard build artifact.
  • Filter/Exclusion: Exclude alerts where the source process is a known build agent (e.g., java.exe, node.exe, or python.exe running under a service account) and the destination path is within a designated build or artifact directory (e.g., C:\Jenkins\workspace\ or /var/lib/jenkins/).
• Scenario: An IT administrator runs a scheduled PowerShell script to perform routine network diagnostics or patch validation, which temporarily connects to an internal staging server or IP address that coincidentally matches an Aisuru IOC (e.g., a known C2 IP used in a test environment or a specific file hash from a vendor tool).
  • Filter/Exclusion: Exclude alerts where the initiating process is powershell.exe or pwsh.exe and the parent process is a scheduled task service (svchost.exe with Tasks or Task Scheduler in the command line) or a known admin tool (e.g., plink.exe, ssh.exe) connecting to an internal IP range (e.g., 10.0.0.0/8, 172.16.0.0/12).
• Scenario: A security team conducts a periodic vulnerability scan or threat hunt using a tool like Nessus, Qualys, or Metasploit, which generates temporary files or network connections that match Aisuru IOCs (e.g., specific file hashes for exploit payloads or known C2 domains used in testing).
  • Filter/Exclusion: Exclude alerts where