ThreatFox: Aisuru IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets the presence of eight known indicators of compromise associated with the Aisuru threat actor, which are frequently used for initial access and command-and-control operations. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify potential intrusions early, as Aisuru is a high-severity threat group known for targeting cloud environments and leveraging specific infrastructure patterns that may otherwise go unnoticed in standard alerting.

IOC Summary

Malware Family: Aisuru Total IOCs: 8 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`159[.]65[.]83[.]2:34567`	botnet_cc	2026-09-21	100%
ip:port	`167[.]71[.]45[.]235:34567`	botnet_cc	2026-09-21	100%
ip:port	`46[.]101[.]36[.]181:8080`	botnet_cc	2026-09-21	100%
ip:port	`46[.]101[.]36[.]181:9034`	botnet_cc	2026-09-21	100%
ip:port	`209[.]38[.]218[.]95:8080`	botnet_cc	2026-09-21	100%
ip:port	`144[.]126[.]234[.]230:9034`	botnet_cc	2026-09-21	100%
ip:port	`178[.]62[.]118[.]210:8080`	botnet_cc	2026-09-21	100%
ip:port	`178[.]128[.]167[.]82:8080`	botnet_cc	2026-09-21	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["159.65.83.2", "144.126.234.230", "178.128.167.82", "178.62.118.210", "209.38.218.95", "167.71.45.235", "46.101.36.181"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["159.65.83.2", "144.126.234.230", "178.128.167.82", "178.62.118.210", "209.38.218.95", "167.71.45.235", "46.101.36.181"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Aisuru

False Positive Guidance

Scenario: A network operations center (NOC) engineer deploys a new version of a third-party endpoint detection and response (EDR) agent or a specific security scanner (e.g., CrowdStrike Falcon, SentinelOne) that utilizes a unique process name or binary hash matching one of the Aisuru IOCs.
- Filter/Exclusion: Exclude processes where the parent process is a known service manager (e.g., svchost.exe, services.exe) and the executable path resides in standard vendor directories (e.g., C:\Program Files\CrowdStrike\, C:\Program Files\SentinelOne\).
Scenario: An IT administrator runs a scheduled PowerShell script to perform routine disk cleanup or log rotation, which temporarily creates a temporary executable or script file in the %TEMP% or %APPDATA% directory that matches a file path or hash IOC associated with Aisuru’s staging techniques.
- Filter/Exclusion: Exclude events where the file path contains \Temp\ or \AppData\Local\Temp\ and the creation time is within the execution window of a known scheduled task (e.g., “Daily Cleanup,” “Log Rotation”) identified by its task name in the Windows Task Scheduler.
Scenario: A developer or DevOps engineer uses a portable version of a common utility (such as 7z.exe, tar.exe, or a custom build tool) for package extraction or compilation in a user’s home directory or a non-standard project folder, triggering a file hash or process name IOC.
- Filter/Exclusion: Exclude processes where the working directory is a user-specific project folder (e.g., C:\Users\<username>\Projects\) or C:\Users\<username>\Downloads\, and the parent process is an IDE or terminal emulator (e.g., code.exe, `powershell