This hunt identifies potential compromise by matching network traffic or asset attributes against known indicators of compromise associated with the Aisuru threat actor. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect stealthy lateral movement or data exfiltration attempts before they escalate into a full-blown breach.
Malware Family: Aisuru Total IOCs: 3 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 164[.]92[.]207[.]173:8080 | botnet_cc | 2026-09-16 | 100% |
| ip:port | 46[.]101[.]169[.]198:8443 | botnet_cc | 2026-09-16 | 100% |
| ip:port | 134[.]209[.]223[.]192:9034 | botnet_cc | 2026-09-16 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["46.101.169.198", "164.92.207.173", "134.209.223.192"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["46.101.169.198", "164.92.207.173", "134.209.223.192"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
curl or wget to download a specific software package (e.g., a JAR file, binary, or configuration script) from a public CDN or internal artifact repository that happens to share the same SHA256 hash or URL path as one of the Aisuru IOCs.
curl/7.68.0, python-requests/2.25.1, or Java/11.0.2).java.exe, node.exe, python3.exe, powershell.exe) AND the parent process is a service manager (e.g., svchost.exe, systemd, init) with a stable, long-running uptime (>24 hours).nslookup or dig to verify DNS resolution for a known external service, and the query hits an IP address associated with the Aisuru IOC list.
nslookup.exe, dig.exe,