ThreatFox: Aisuru IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific Indicators of Compromise (IOCs) linked to the Aisuru threat actor, which often signals early-stage reconnaissance or lateral movement within the network. Proactively hunting for these IOCs in Azure Sentinel is critical because Aisuru’s high-severity indicators can reveal stealthy intrusions that may bypass standard automated alerts, enabling the SOC team to initiate rapid containment before data exfiltration occurs.

IOC Summary

Malware Family: Aisuru Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["89.19.223.68", "91.108.249.56"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["89.19.223.68", "91.108.249.56"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Aisuru

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Aisuru IOCs detection rule, including tailored filters and exclusions suitable for an enterprise environment:

• Scenario: Security Team Manual Threat Hunting via EDR Console

  • Context: SOC analysts or threat hunters frequently query known malicious hashes or domains (associated with the Aisuru campaign) within their Endpoint Detection and Response (EDR) platform to verify current infection status across the fleet.
  • Filter/Exclusion: Create a rule exclusion that ignores alerts where the Source User is a member of the “SOC_Analysts” or “Threat_Hunters” Active Directory group, OR where the Process Name matches EDR management tools like SentinelOneAgent.exe, CrowdStrikeService.exe, or CarbonBlackClient.exe.

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise endpoint protection suites (e.g., Microsoft Defender for Endpoint, Symantec Endpoint Protection) automatically download and process new signature definitions containing Aisuru IOCs during off-hours maintenance windows. This triggers the detection logic as the AV engine “sees” the IOCs in its local database or network traffic.
  • Filter/Exclusion: Exclude alerts generated by processes running under the SYSTEM account during scheduled maintenance windows (e.g., 02:00–04:00 UTC). Specifically, filter out events where the Process Name is MsMpEng.exe (Defender) or Rtvscan64.exe (Symantec) and the Event Type indicates “Definition Update” rather than “Network Connection.”

• Scenario: Automated Vulnerability Scanning by Qualys/Tenable

  • Context: Network vulnerability scanners periodically probe internal assets to check for known threat indicators. When a scanner (