ThreatFox: Aisuru IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity by correlating network and endpoint telemetry against a curated set of 14 Indicators of Compromise (IOCs) specific to the Aisuru threat actor. Proactively hunting for these IOCs in Azure Sentinel is critical to identify early-stage intrusions from this known actor, enabling rapid containment before lateral movement or data exfiltration occurs.

IOC Summary

Malware Family: Aisuru Total IOCs: 14 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`167[.]172[.]71[.]69:8080`	botnet_cc	2026-08-01	100%
ip:port	`137[.]184[.]70[.]190:8001`	botnet_cc	2026-08-01	100%
ip:port	`103[.]214[.]146[.]46:8443`	botnet_cc	2026-08-01	100%
ip:port	`206[.]189[.]81[.]41:9034`	botnet_cc	2026-08-01	100%
ip:port	`206[.]189[.]81[.]41:8443`	botnet_cc	2026-08-01	100%
ip:port	`167[.]99[.]64[.]180:8443`	botnet_cc	2026-08-01	100%
ip:port	`47[.]107[.]224[.]89:34567`	botnet_cc	2026-08-01	100%
ip:port	`167[.]99[.]64[.]180:8080`	botnet_cc	2026-08-01	100%
ip:port	`167[.]172[.]71[.]69:8443`	botnet_cc	2026-08-01	100%
ip:port	`143[.]198[.]206[.]191:8443`	botnet_cc	2026-08-01	100%
ip:port	`206[.]189[.]81[.]41:8080`	botnet_cc	2026-08-01	100%
ip:port	`137[.]184[.]199[.]120:34567`	botnet_cc	2026-08-01	100%
ip:port	`178[.]128[.]22[.]21:8443`	botnet_cc	2026-08-01	100%
ip:port	`167[.]99[.]64[.]180:9034`	botnet_cc	2026-08-01	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["137.184.199.120", "167.99.64.180", "137.184.70.190", "167.172.71.69", "178.128.22.21", "206.189.81.41", "47.107.224.89", "143.198.206.191", "103.214.146.46"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["137.184.199.120", "167.99.64.180", "137.184.70.190", "167.172.71.69", "178.128.22.21", "206.189.81.41", "47.107.224.89", "143.198.206.191", "103.214.146.46"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Aisuru

False Positive Guidance

False Positive Scenarios for “ThreatFox: Aisuru IOCs” Rule

Scenario: Legitimate Endpoint Protection Updates via Microsoft Defender for Endpoint
- Context: The detection triggers when the Microsoft Defender Antivirus service (MsMpEng.exe) downloads and verifies signature definitions or engine updates that contain file hashes matching the Aisuru IOC set. This often occurs during scheduled nightly update windows where the AV client pulls new threat intelligence feeds from the cloud.
- Suggested Filter: Exclude processes with ImageName containing MsMpEng.exe OR MsSense.exe when the parent process is ServiceHost.exe running under the SYSTEM account, specifically during the defined maintenance window (e.g., 02:00–04:00 local time).
Scenario: Scheduled Third-Party Backup Agent Scans
- Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault run scheduled jobs that scan and index large file repositories. If the Aisuru IOCs include specific DLLs or configuration files used by these agents, the rule may flag legitimate backup metadata processing as a threat match when the agent reads these files during an incremental backup job.
- Suggested Filter: Create an exclusion for process trees where the root parent is VeeamTransportService.exe (or commvault_agent.exe) and the file path resides within known backup directories (e.g., C:\Program Files\Veeam\Backup\...).
Scenario: Automated Software Deployment via SCCM/Intune
- Context: The System Center Configuration Manager (SCCM) or Microsoft Intune deploys a new application package that includes a component with a hash identical to one of the Aisuru IOCs. During the installation phase, the deployment engine extracts and executes this specific file, causing the detection rule to