This hunt detects adversary activity involving specific indicators of compromise (IOCs) linked to the Aisuru threat actor, which often signals early-stage reconnaissance or lateral movement within the network. Proactively hunting for these IOCs in Azure Sentinel is critical because high-severity detections from known actors like Aisuru can reveal stealthy threats that may bypass standard signature-based defenses and require immediate investigation to prevent potential data exfiltration.
Malware Family: Aisuru Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 45[.]77[.]32[.]3:9034 | botnet_cc | 2026-07-23 | 100% |
| ip:port | 207[.]148[.]66[.]2:34567 | botnet_cc | 2026-07-23 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["45.77.32.3", "207.148.66.2"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.77.32.3", "207.148.66.2"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding filters for the ThreatFox: Aisuru IOCs detection rule in an enterprise environment:
Scenario: The IT Operations team runs a nightly vulnerability scan using Tenable Nessus, which includes a signature library update that references Aisuru’s public threat intelligence feed as part of its baseline configuration. This triggers the rule when the scanner queries external Aisuru endpoints to validate local signatures.
Tenable-Scanner-01, Tenable-Scanner-02) during the scheduled maintenance window (02:00–04:00 UTC).Scenario: The Security Engineering group utilizes a custom Python script executed via Windows Task Scheduler to aggregate daily threat intel from multiple vendors, including Aisuru. This script (threat_intel_aggregator.py) fetches JSON feeds containing Aisuru IOCs for local analysis, generating legitimate network connections and file reads that match the detection logic.
C:\Scripts\ThreatIntel\threat_intel_aggregator.py and the specific scheduled task name Daily_Threat_Aggregation, ensuring these executions do not trigger alerts regardless of Aisuru IOC matches.Scenario: The DevOps team deploys a new containerized application using Ansible playbooks that include a dependency check against the Aisuru repository to verify library integrity before deployment. This activity occurs during the daily CI/CD pipeline run, causing legitimate API calls and file downloads associated with Aisuru IOCs.