ThreatFox: Aisuru IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific Indicators of Compromise (IOCs) linked to the Aisuru threat actor, enabling the identification of potential reconnaissance or initial access attempts within the environment. Proactively hunting for these IOCs in Azure Sentinel is critical because early detection of known Aisuru signatures allows the SOC team to rapidly isolate affected assets and mitigate risks before the adversary establishes a persistent foothold.

IOC Summary

Malware Family: Aisuru Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["46.101.146.87", "104.248.41.207", "43.129.180.120"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["46.101.146.87", "104.248.41.207", "43.129.180.120"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Aisuru

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: Aisuru IOCs detection rule in an enterprise environment:

• Endpoint Protection Management Console Updates

  • Scenario: The centralized management server (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) initiates a scheduled update cycle to download the latest Aisuru threat intelligence feed. This process generates network connections and file creation events matching the rule’s IOCs, even though no actual malware is present on endpoints.
  • Filter/Exclusion: Create an exclusion based on the Source Host (e.g., Management-Server-01) or filter out traffic where the Process Name matches the management agent service (e.g., FalconSensor.exe, MsSenseService.exe) running under a known administrative account.

• Scheduled Threat Intelligence Ingestion Jobs

  • Scenario: A dedicated SIEM or SOAR engine (such as Splunk, IBM QRadar, or Tenable.io) runs a nightly scheduled job to ingest and parse external threat feeds, including the Aisuru dataset. The ingestion script actively queries the IOCs defined in the rule, triggering alerts during the window of execution (e.g., 02:00 – 04:00 UTC).
  • Filter/Exclusion: Implement a time-based exclusion for the specific Scheduled Task Name (e.g., ThreatFeed_Ingestion_Job) or add an IP range exclusion for the SOAR engine’s internal interface, ensuring alerts only fire outside of the defined maintenance window.

• Security Research & Threat Hunting Queries

  • Scenario: Security analysts manually execute a hunt package or run a custom PowerShell script to investigate potential Aisuru-related activity across the network. These manual queries explicitly search for