ThreatFox: Aisuru IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity by correlating network and endpoint telemetry against fifteen specific Indicators of Compromise (IOCs) linked to the Aisuru threat actor. Proactively hunting for these signatures in Azure Sentinel is critical because Aisuru’s high-severity footprint suggests sophisticated, targeted campaigns that require immediate identification before lateral expansion occurs.

IOC Summary

Malware Family: Aisuru Total IOCs: 15 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`132[.]243[.]199[.]3:8443`	botnet_cc	2026-07-10	100%
ip:port	`91[.]108[.]249[.]140:34567`	botnet_cc	2026-07-10	100%
ip:port	`91[.]108[.]249[.]186:34567`	botnet_cc	2026-07-10	100%
ip:port	`134[.]122[.]98[.]48:8001`	botnet_cc	2026-07-10	100%
ip:port	`138[.]68[.]138[.]44:8001`	botnet_cc	2026-07-10	100%
ip:port	`165[.]232[.]71[.]140:8001`	botnet_cc	2026-07-10	100%
ip:port	`206[.]189[.]119[.]212:8001`	botnet_cc	2026-07-10	100%
ip:port	`138[.]68[.]93[.]46:8001`	botnet_cc	2026-07-10	100%
ip:port	`167[.]99[.]143[.]174:8001`	botnet_cc	2026-07-10	100%
ip:port	`164[.]92[.]179[.]21:8001`	botnet_cc	2026-07-10	100%
ip:port	`64[.]227[.]117[.]72:8001`	botnet_cc	2026-07-10	100%
ip:port	`159[.]65[.]61[.]151:8001`	botnet_cc	2026-07-10	100%
ip:port	`139[.]59[.]161[.]246:8001`	botnet_cc	2026-07-10	100%
ip:port	`91[.]108[.]249[.]140:8080`	botnet_cc	2026-07-10	100%
ip:port	`138[.]68[.]93[.]46:34567`	botnet_cc	2026-07-10	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["167.99.143.174", "165.232.71.140", "164.92.179.21", "159.65.61.151", "206.189.119.212", "91.108.249.186", "138.68.138.44", "91.108.249.140", "134.122.98.48", "132.243.199.3", "139.59.161.246", "138.68.93.46", "64.227.117.72"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["167.99.143.174", "165.232.71.140", "164.92.179.21", "159.65.61.151", "206.189.119.212", "91.108.249.186", "138.68.138.44", "91.108.249.140", "134.122.98.48", "132.243.199.3", "139.59.161.246", "138.68.93.46", "64.227.117.72"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Aisuru

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Aisuru IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Security Operations Center (SOC) Threat Intelligence Ingestion Jobs
- Scenario: The SIEM or EDR platform (e.g., Splunk, Microsoft Sentinel, or CrowdStrike Falcon) runs a scheduled nightly job to ingest and parse the latest Aisuru threat intelligence feeds. This process involves downloading IOC files from the vendor’s repository, which triggers network connections to Aisuru IP addresses and file hashes matching the detection logic.
- Filter/Exclusion: Exclude traffic originating from known SOC infrastructure subnets (e.g., 10.50.20.0/24) or specific service accounts used for threat ingestion (e.g., svc_threat_intel_ingest). Additionally, filter out events where the destination port is 80/443 and the user agent string contains “ThreatIntel-Connector”.
Endpoint Protection Policy Updates via Central Management Console
- Scenario: The IT security team pushes a global policy update through the endpoint management console (e.g., Ivanti, SCCM, or Tanium) that includes signature updates referencing Aisuru definitions. This triggers background processes on thousands of workstations to download and validate specific IOCs associated with the Aisuru package during business hours.
- Filter/Exclusion: Create an exclusion for events generated by the “System” account or specific service accounts (e.g., svc_epm_updater) running known management tools. Filter out alerts where the process path matches the standard installation directory of the endpoint management agent (e.g., C:\Program Files\Tanium\Agent\).
Automated Vulnerability Scanning and Compliance Audits
- Scenario: