ThreatFox: Aisuru IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets adversary activity linked to the Aisuru threat actor by correlating nine specific Indicators of Compromise (IOCs) against Azure Sentinel logs to identify potential lateral movement or command-and-control communications. Proactively hunting for these signatures is critical because early detection of Aisuru’s known artifacts allows the SOC team to validate exposure and initiate rapid containment before the adversary establishes a persistent foothold within the environment.

IOC Summary

Malware Family: Aisuru Total IOCs: 9 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`159[.]65[.]143[.]171:8080`	botnet_cc	2026-07-20	100%
ip:port	`137[.]184[.]135[.]42:9034`	botnet_cc	2026-07-20	100%
ip:port	`168[.]144[.]135[.]136:8443`	botnet_cc	2026-07-20	100%
ip:port	`161[.]35[.]125[.]247:9035`	botnet_cc	2026-07-20	100%
ip:port	`162[.]243[.]163[.]143:8080`	botnet_cc	2026-07-20	100%
ip:port	`162[.]243[.]163[.]143:8443`	botnet_cc	2026-07-20	100%
ip:port	`159[.]65[.]143[.]171:37215`	botnet_cc	2026-07-20	100%
ip:port	`159[.]65[.]143[.]171:34567`	botnet_cc	2026-07-20	100%
ip:port	`167[.]172[.]80[.]107:9035`	botnet_cc	2026-07-20	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["167.172.80.107", "161.35.125.247", "137.184.135.42", "168.144.135.136", "159.65.143.171", "162.243.163.143"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["167.172.80.107", "161.35.125.247", "137.184.135.42", "168.144.135.136", "159.65.143.171", "162.243.163.143"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Aisuru

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Aisuru IOCs detection rule in an enterprise environment, along with recommended filters or exclusions:

Endpoint Security Agent Updates & Definitions Sync
- Scenario: The organization’s endpoint protection solution (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) performs a scheduled definition update. During this process, the agent downloads and executes a new signature package that includes Aisuru-related IOCs as part of its internal threat intelligence feed, triggering network connections to known Aisuru IP addresses or hash matches on the host.
- Filter/Exclusion: Exclude traffic originating from the specific service accounts used by the EDR agent (e.g., svc-crowdstrike, LocalSystem running C:\Program Files\CrowdStrike\fs.exe) and filter out connections to Aisuru IOCs that occur strictly during the defined maintenance window (e.g., 02:00–04:00 UTC).
Third-Party Vulnerability Scanner Scans
- Scenario: An enterprise vulnerability management tool (such as Tenable Nessus, Qualys, or Rapid7 InsightVM) runs a scheduled scan against the internal asset inventory. The scanner’s engine includes Aisuru IOCs in its reference library to validate system configurations or check for known malicious artifacts, generating legitimate network flows and file hash matches on the scanned hosts.
- Filter/Exclusion: Create an exclusion rule based on the source IP address of the vulnerability scanner management server (e.g., 10.20.30.50) and exclude events where the process name matches the scanner’s executable (e.g., nessus.exe, qualys_agent_service).
Patch Management Deployment (WSUS/SCCM)
- **Scenario