This hunt targets known indicators of compromise associated with the Aisuru threat actor to identify potential lateral movement or persistence mechanisms within the environment. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect stealthy adversary activity and isolate affected assets before the threat actor can escalate privileges or exfiltrate data.
Malware Family: Aisuru Total IOCs: 7 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 134[.]122[.]68[.]91:9034 | botnet_cc | 2026-09-04 | 100% |
| ip:port | 152[.]42[.]247[.]65:8443 | botnet_cc | 2026-09-04 | 100% |
| ip:port | 176[.]98[.]182[.]216:37215 | botnet_cc | 2026-09-04 | 100% |
| ip:port | 139[.]59[.]178[.]162:8443 | botnet_cc | 2026-09-04 | 100% |
| ip:port | 178[.]128[.]36[.]32:8443 | botnet_cc | 2026-09-04 | 100% |
| ip:port | 176[.]98[.]182[.]216:12345 | botnet_cc | 2026-09-04 | 100% |
| ip:port | 164[.]90[.]172[.]4:9034 | botnet_cc | 2026-09-04 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["176.98.182.216", "139.59.178.162", "152.42.247.65", "164.90.172.4", "178.128.36.32", "134.122.68.91"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["176.98.182.216", "139.59.178.162", "152.42.247.65", "164.90.172.4", "178.128.36.32", "134.122.68.91"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., Jenkins or GitLab CI) to deploy a new microservice that includes a dependency on a library version matching one of the Aisuru IOCs (e.g., a specific python package hash or node module). The deployment script copies the artifact to the target server, triggering a file hash match.
C:\Jenkins\workspace\, /var/lib/jenkins/, or C:\GitLab\runner\) and exclude processes initiated by java.exe (Jenkins) or node.exe (GitLab CI) when the parent process is a known build agent.Scenario: An IT administrator performs a routine patching cycle using a tool like SCCM (System Center Configuration Manager) or Ansible, which downloads and installs a specific version of a third-party application (e.g., a Java JRE or .NET Framework update) that matches an IOC hash. The installation process writes the file to C:\Windows\Temp\ or the application’s install directory.
ccmsetup.exe (SCCM), ansible.exe, or powershell.exe with a parent process of wuauserv (Windows Update) or svchost.exe (if part of a service update), and limit exclusions to known patching time windows (e.g., 02:00–06:00 AM).Scenario: A security team runs a YARA or ClamAV scan across the network share \\fileserver\departments\ to validate a new signature set. The scanner reads a legitimate user document or shared library file that happens to match a known