ThreatFox: Aisuru IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets known indicators of compromise associated with the Aisuru threat actor, enabling the detection of potential lateral movement or persistence mechanisms within the environment. Proactively hunting for these IOCs is critical because Aisuru is a high-severity threat group that frequently leverages Azure services for command and control, allowing the SOC to identify and isolate compromised assets before they can establish a foothold.

IOC Summary

Malware Family: Aisuru Total IOCs: 3 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`165[.]227[.]142[.]229:9034`	botnet_cc	2026-09-13	100%
ip:port	`64[.]225[.]107[.]48:12345`	botnet_cc	2026-09-13	100%
ip:port	`209[.]38[.]225[.]90:34567`	botnet_cc	2026-09-13	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["64.225.107.48", "209.38.225.90", "165.227.142.229"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["64.225.107.48", "209.38.225.90", "165.227.142.229"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Aisuru

False Positive Guidance

Scenario: A DevOps engineer uses kubectl or docker CLI to inspect container images or pull secrets, where the image digest or tag string matches one of the Aisuru IOCs (e.g., a specific hash or URL fragment) in the image metadata or pull request logs.
- Filter/Exclusion: Exclude events where the source process is kubectl, docker, or containerd and the command line contains pull, inspect, or tag.
Scenario: An automated CI/CD pipeline (e.g., Jenkins, GitLab CI) executes a build step that downloads a dependency or artifact from a public registry, and the downloaded file’s SHA256 or URL matches an Aisuru IOC due to a shared library or common open-source component.
- Filter/Exclusion: Exclude events originating from known CI/CD service accounts (e.g., jenkins-sa, gitlab-runner) or processes like curl, wget, npm, pip when the working directory is under /builds/, /workspace/, or /ci/.
Scenario: A security scanner (e.g., Nessus, Qualys, or a custom YARA-based scanner) performs a file sweep or memory scan, generating detection events for files that match Aisuru IOCs but are part of a known-good application bundle or test fixture.
- Filter/Exclusion: Exclude events where the source process is a known scanner binary (e.g., nessus-agent, qualys-agent, yara) or the file path contains /scans/, /quarantine/, or /test-fixtures/.
Scenario: An IT administrator runs a PowerShell script to audit or clean up temporary files, and the script references an Aisuru IOC string (e.g., in a comment