ThreatFox: Aisuru IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets the presence of known Aisuru indicators of compromise, which may signal an active intrusion or persistent access by this threat actor. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised assets early, enabling rapid containment and reducing the potential impact of the high-severity Aisuru campaign.

IOC Summary

Malware Family: Aisuru Total IOCs: 11 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`209[.]38[.]225[.]90:8080`	botnet_cc	2026-09-12	100%
ip:port	`138[.]68[.]130[.]69:34567`	botnet_cc	2026-09-12	100%
ip:port	`209[.]38[.]225[.]90:9035`	botnet_cc	2026-09-12	100%
ip:port	`138[.]68[.]242[.]177:8443`	botnet_cc	2026-09-12	100%
ip:port	`165[.]227[.]142[.]229:8080`	botnet_cc	2026-09-12	100%
ip:port	`159[.]223[.]13[.]6:34567`	botnet_cc	2026-09-12	100%
ip:port	`159[.]65[.]59[.]117:8080`	botnet_cc	2026-09-12	100%
ip:port	`165[.]22[.]113[.]73:8443`	botnet_cc	2026-09-12	100%
ip:port	`138[.]197[.]211[.]43:9034`	botnet_cc	2026-09-12	100%
ip:port	`159[.]89[.]207[.]12:8080`	botnet_cc	2026-09-12	100%
ip:port	`138[.]197[.]211[.]43:8443`	botnet_cc	2026-09-12	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["138.197.211.43", "159.89.207.12", "165.22.113.73", "159.65.59.117", "138.68.242.177", "165.227.142.229", "138.68.130.69", "209.38.225.90", "159.223.13.6"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["138.197.211.43", "159.89.207.12", "165.22.113.73", "159.65.59.117", "138.68.242.177", "165.227.142.229", "138.68.130.69", "209.38.225.90", "159.223.13.6"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Aisuru

False Positive Guidance

Scenario: A DevOps team uses curl or wget to download specific configuration files or software packages from a known third-party CDN or internal artifact repository that happens to share an IP address or domain with an Aisuru IOC (e.g., 185.177.72.15 or aisuru[.]com).
- Filter/Exclusion: Exclude alerts where the source process is curl.exe, wget.exe, or powershell.exe and the destination URL matches a known internal artifact repository domain (e.g., artifacts.internal.corp.com) or a whitelisted public CDN (e.g., cdn.jsdelivr.net).
Scenario: An automated backup or log rotation script (e.g., rsync or a custom Python script) connects to a remote storage server or log aggregation endpoint (e.g., logs.example.com) that has been recently identified in the Aisuru IOC list due to a shared hosting provider or DNS round-robin.
- Filter/Exclusion: Exclude alerts where the source process is a known backup utility (e.g., vssadmin.exe, wbadmin.exe, rsync) or a scheduled task named *Backup* or *LogRotation* and the destination port is 443 or 80.
Scenario: A security scanner (e.g., Nessus, Qualys, or Rapid7 InsightVM) performs a web-based vulnerability assessment against internal web servers, generating outbound connections to known Aisuru IOCs if the scanner’s update server or reporting endpoint overlaps with the IOC list.
- Filter/Exclusion: Exclude alerts where the source process is a known vulnerability scanner (e.g., nessus.exe, qualys_agent.exe, insightvm.exe) and the connection is initiated by a service account