ThreatFox: Aisuru IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt identifies potential Aisuru threat actor activity by correlating 12 known indicators of compromise, such as malicious IPs and domains, against Azure Sentinel telemetry. Proactively hunting for these IOCs is critical because Aisuru is a high-severity threat actor that frequently leverages initial access vectors to establish footholds in cloud environments, enabling early detection before lateral movement or data exfiltration occurs.

IOC Summary

Malware Family: Aisuru Total IOCs: 12 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`176[.]98[.]182[.]218:34567`	botnet_cc	2026-09-03	100%
ip:port	`138[.]68[.]169[.]201:8080`	botnet_cc	2026-09-03	100%
ip:port	`206[.]189[.]127[.]191:8443`	botnet_cc	2026-09-03	100%
ip:port	`157[.]245[.]242[.]229:34567`	botnet_cc	2026-09-03	100%
ip:port	`165[.]22[.]242[.]128:8443`	botnet_cc	2026-09-03	100%
ip:port	`176[.]98[.]182[.]217:5555`	botnet_cc	2026-09-03	100%
ip:port	`165[.]227[.]92[.]224:34567`	botnet_cc	2026-09-03	100%
ip:port	`178[.]128[.]173[.]150:9034`	botnet_cc	2026-09-03	100%
ip:port	`157[.]245[.]242[.]229:8443`	botnet_cc	2026-09-03	100%
ip:port	`188[.]166[.]146[.]72:8080`	botnet_cc	2026-09-03	100%
ip:port	`152[.]42[.]247[.]65:8080`	botnet_cc	2026-09-03	100%
ip:port	`165[.]22[.]242[.]128:9034`	botnet_cc	2026-09-03	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["176.98.182.218", "178.128.173.150", "157.245.242.229", "165.22.242.128", "188.166.146.72", "206.189.127.191", "152.42.247.65", "176.98.182.217", "138.68.169.201", "165.227.92.224"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["176.98.182.218", "178.128.173.150", "157.245.242.229", "165.22.242.128", "188.166.146.72", "206.189.127.191", "152.42.247.65", "176.98.182.217", "138.68.169.201", "165.227.92.224"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Aisuru

False Positive Guidance

Scenario: A DevOps engineer uses curl to download a specific configuration bundle or dependency package from a public CDN or internal artifact repository that happens to share an IP or domain hash with an Aisuru IOC.
- Filter/Exclusion: Exclude alerts where the source process is curl.exe or wget.exe and the destination path is within standard development directories (e.g., C:\Users\<user>\.nuget\, C:\dev\, or node_modules\).
Scenario: An IT administrator runs a scheduled PowerShell script to check service health or update certificates, which connects to an internal monitoring endpoint or certificate authority that is coincidentally listed in the ThreatFox Aisuru IOC set due to shared infrastructure or IP range.
- Filter/Exclusion: Exclude alerts triggered by known service accounts (e.g., svc-monitoring, admin-certbot) or processes like powershell.exe initiated by schtasks or Task Scheduler with a specific parent process chain.
Scenario: A third-party SaaS application (e.g., Slack, Zoom, or a CI/CD tool like Jenkins) uses a shared cloud provider IP range that overlaps with an Aisuru C2 server IP, causing the connection to be flagged during routine API calls or file uploads.
- Filter/Exclusion: Maintain a whitelist of known SaaS provider IP ranges or exclude alerts where the source process is associated with specific SaaS executables (e.g., slack.exe, zoom.exe, jenkins-agent.exe) and the connection port is standard (443, 8080).
Scenario: A security team performs a red team exercise or a vulnerability scan using a tool like Nmap or Masscan that probes a subset of the Aisuru IOC IPs to verify detection coverage, triggering the rule intentionally.