This hunt identifies network connections to known Aisuru infrastructure, a threat actor frequently associated with ransomware deployments and initial access via exposed services. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect early-stage lateral movement or command-and-control channels before the adversary can establish persistence or encrypt critical workloads.
Malware Family: Aisuru Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 43[.]173[.]38[.]253:5555 | botnet_cc | 2026-09-23 | 100% |
| ip:port | 130[.]78[.]189[.]71:8080 | botnet_cc | 2026-09-23 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["130.78.189.71", "43.173.38.253"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["130.78.189.71", "43.173.38.253"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Legitimate Patch Management via WSUS or SCCM: Enterprise environments often use Windows Server Update Services (WSUS) or System Center Configuration Manager (SCCM) to distribute updates. If the Aisuru IOCs include specific hash values or file paths associated with common update packages or temporary staging directories (e.g., C:\Windows\SoftwareDistribution\), these legitimate system maintenance tasks can trigger the rule.
wuauclt.exe (Windows Update) or ccmexec.exe (SCCM Agent), or filter out file paths containing SoftwareDistribution and Updates directories.Third-Party Antivirus or EDR Quarantine Operations: Security tools like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Trend Micro often create temporary files or quarantine archives in standard system locations. If the Aisuru IOCs target specific file extensions (e.g., .zip, .cab) or temporary folders (e.g., C:\ProgramData\), the act of quarantining or extracting malicious files by the AV itself can mimic the IOC pattern.
FalconSensor.exe, MsMpEng.exe, Tmcc.exe) or where the file path resides within the vendor’s specific data directory (e.g., C:\ProgramData\CrowdStrike\, C:\ProgramData\Microsoft\Windows Defender\).Scheduled Backup Jobs Using Veeam or Commvault: Enterprise backup solutions frequently write large data files to temporary staging areas or network shares. If the Aisuru IOCs include generic file names or hashes that coincidentally match backup metadata files, log archives, or temporary restore points, these scheduled jobs (often running under SYSTEM or a dedicated backup service account