This hunt targets the presence of 13 known indicators of compromise associated with the Aisuru threat actor, enabling the detection of potential intrusions that may have bypassed traditional signature-based defenses. Proactively hunting for these IOCs in Azure Sentinel is critical to identify lateral movement or persistence mechanisms early, as Aisuru is a high-severity threat known for targeting enterprise environments through sophisticated initial access and post-exploitation tactics.
Malware Family: Aisuru Total IOCs: 13 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 159[.]203[.]178[.]139:34567 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 159[.]65[.]83[.]2:8080 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 159[.]65[.]83[.]2:8443 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 159[.]65[.]83[.]2:37215 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 46[.]101[.]36[.]181:8443 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 138[.]68[.]168[.]41:8443 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 167[.]71[.]45[.]235:9034 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 43[.]155[.]214[.]112:8443 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 178[.]128[.]167[.]82:8443 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 144[.]126[.]234[.]230:8443 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 167[.]71[.]45[.]235:8443 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 159[.]65[.]83[.]2:9034 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 138[.]68[.]168[.]41:8080 | botnet_cc | 2026-09-20 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["167.71.45.235", "138.68.168.41", "159.203.178.139", "43.155.214.112", "144.126.234.230", "46.101.36.181", "178.128.167.82", "159.65.83.2"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["167.71.45.235", "138.68.168.41", "159.203.178.139", "43.155.214.112", "144.126.234.230", "46.101.36.181", "178.128.167.82", "159.65.83.2"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
PowerShell to deploy a new internal monitoring agent (e.g., Datadog or New Relic) across a fleet of Windows servers, where the deployment script downloads a binary from an internal artifact repository that shares a hash or URL pattern with an Aisuru IOC.
10.0.0.0/8) and the user account belongs to the ServiceAccount-DevOps group.Task Scheduler to execute a cleanup script that deletes temporary files and logs, which involves creating a new process or modifying registry keys in a way that matches the behavioral IOC for Aisuru’s persistence mechanism.
Task Scheduler service (svchost.exe or taskschd.exe) if the parent process is taskschd.exe and the task name contains standard prefixes like Corp- or Internal-.Cobalt Strike beacon) in an isolated lab environment, but the lab VMs are inadvertently connected to the production network segment, causing the IOC to fire.
Environment=Lab or Tag=RedTeam in the asset inventory, or where the source MAC address matches the known lab switch range.