ThreatFox: Aisuru IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity by correlating network and endpoint telemetry against nine specific Indicators of Compromise (IOCs) linked to the Aisuru threat actor. Proactively hunting for these IOCs in Azure Sentinel is critical because it enables early identification of potential intrusions before they escalate, allowing the SOC team to rapidly isolate affected assets and mitigate risks associated with this high-severity campaign.

IOC Summary

Malware Family: Aisuru Total IOCs: 9 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`188[.]166[.]222[.]192:8443`	botnet_cc	2026-08-06	100%
ip:port	`38[.]207[.]178[.]195:8001`	botnet_cc	2026-08-06	100%
ip:port	`167[.]172[.]188[.]177:8001`	botnet_cc	2026-08-06	100%
ip:port	`159[.]203[.]172[.]232:8001`	botnet_cc	2026-08-06	100%
ip:port	`188[.]166[.]222[.]192:8001`	botnet_cc	2026-08-06	100%
ip:port	`161[.]35[.]48[.]40:8001`	botnet_cc	2026-08-06	100%
ip:port	`165[.]245[.]178[.]39:8001`	botnet_cc	2026-08-06	100%
ip:port	`139[.]59[.]144[.]8:8001`	botnet_cc	2026-08-06	100%
ip:port	`38[.]207[.]178[.]195:8443`	botnet_cc	2026-08-06	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["161.35.48.40", "165.245.178.39", "159.203.172.232", "139.59.144.8", "188.166.222.192", "167.172.188.177", "38.207.178.195"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["161.35.48.40", "165.245.178.39", "159.203.172.232", "139.59.144.8", "188.166.222.192", "167.172.188.177", "38.207.178.195"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Aisuru

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: Aisuru IOCs detection rule:

Scenario 1: Scheduled Antivirus Definition Updates via Windows Update Agent
- Context: The enterprise uses Microsoft Defender for Endpoint (or a similar AV) which periodically downloads definition updates from a vendor repository that shares network infrastructure or IP ranges with the Aisuru threat cluster. The detection logic flags these routine update connections as suspicious IOCs.
- Filter/Exclusion: Create an exclusion rule based on the specific process name UsocDl.exe (Windows Update Orchestrator) and restrict it to the known internal update server IP range or the specific vendor URL pattern used for definition feeds.
Scenario 2: Automated Backup Jobs Executed by Veeam Backup & Replication
- Context: A nightly scheduled job runs using Veeam.Backup.Service.exe to connect to an off-site cloud storage repository. The destination IP or the specific DNS query generated during the handshake matches one of the 9 Aisuru IOCs, triggering a false alert due to the backup traffic volume and external connectivity.
- Filter/Exclusion: Exclude traffic originating from the Veeam.Backup.Service.exe process (PID verification) where the destination port is restricted to standard backup ports (e.g., 443, 9500) and the source machine belongs to the “Backup-Servers” Active Directory security group.
Scenario 3: Third-Party SIEM Log Forwarding via Splunk Universal Forwarder
- Context: The organization utilizes a Splunk Universal Forwarder (splunkd.exe) to ship logs to an external cloud ingestion endpoint. The forwarder’s configuration includes a specific DNS resolution or IP connection that overlaps with the Aisuru IOC list, causing the