ThreatFox: Aisuru IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets the presence of nine known indicators of compromise associated with the Aisuru threat actor, which often leverage these artifacts for initial access or lateral movement. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify potential footholds or active intrusions before the adversary can establish persistence or escalate privileges within the environment.

IOC Summary

Malware Family: Aisuru Total IOCs: 9 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`130[.]78[.]189[.]71:8443`	botnet_cc	2026-09-22	100%
ip:port	`138[.]68[.]168[.]41:34567`	botnet_cc	2026-09-22	100%
ip:port	`159[.]203[.]178[.]139:9034`	botnet_cc	2026-09-22	100%
ip:port	`134[.]209[.]106[.]204:34567`	botnet_cc	2026-09-22	100%
ip:port	`130[.]78[.]189[.]71:8001`	botnet_cc	2026-09-22	100%
ip:port	`134[.]209[.]106[.]204:9034`	botnet_cc	2026-09-22	100%
ip:port	`43[.]173[.]38[.]253:12345`	botnet_cc	2026-09-22	100%
ip:port	`43[.]173[.]38[.]253:9034`	botnet_cc	2026-09-22	100%
ip:port	`43[.]173[.]38[.]253:34567`	botnet_cc	2026-09-22	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["159.203.178.139", "138.68.168.41", "134.209.106.204", "43.173.38.253", "130.78.189.71"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["159.203.178.139", "138.68.168.41", "134.209.106.204", "43.173.38.253", "130.78.189.71"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Aisuru

False Positive Guidance

Scenario: A DevOps team deploys a new containerized microservice using a base image that includes a shared library or binary with a hash matching one of the Aisuru IOCs (e.g., a common libcrypto or openssl variant).
- Filter/Exclusion: Exclude alerts where the process path resides under standard container runtime directories (e.g., /var/lib/docker/, /var/lib/kubelet/, or /usr/lib/) and the parent process is a known container engine (dockerd, containerd, crio).
Scenario: An IT administrator runs a legacy backup utility or a specific third-party endpoint agent (e.g., a custom-built backup_agent.exe or sync_tool) that was compiled from source code sharing a similar structure or hash with an Aisuru implant.
- Filter/Exclusion: Exclude alerts where the executable name matches known internal utility names (e.g., internal_backup.exe, corp_sync_agent) and the file location is within the designated C:\Program Files\InternalTools\ or D:\Backups\ directories.
Scenario: A security engineer performs a manual threat hunt or validation test by deploying a known Aisuru sample (or a copy of its IOCs) to a non-production test VM to verify detection coverage.
- Filter/Exclusion: Exclude alerts originating from hosts tagged with Environment: Test or Role: SecurityLab in the asset management system, or where the user account belongs to the SecurityOps group.
Scenario: A developer uses a cross-platform build tool (e.g., mingw-w64 or zig) that bundles a static library with a hash matching an Aisuru IOC during a local compilation or packaging step on a developer workstation.
- **Filter/Ex