This hunt targets the presence of known Aisuru indicators of compromise, which are frequently used by threat actors to establish persistence or execute malicious payloads within the environment. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify potential intrusions early, leveraging high-severity intelligence to detect stealthy activity before it escalates into a full-blown breach.
Malware Family: Aisuru Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 134[.]122[.]68[.]91:8080 | botnet_cc | 2026-09-06 | 100% |
| ip:port | 164[.]90[.]172[.]4:12345 | botnet_cc | 2026-09-06 | 100% |
| ip:port | 176[.]98[.]182[.]218:5555 | botnet_cc | 2026-09-06 | 100% |
| ip:port | 206[.]189[.]127[.]191:8080 | botnet_cc | 2026-09-06 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["134.122.68.91", "164.90.172.4", "176.98.182.218", "206.189.127.191"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["134.122.68.91", "164.90.172.4", "176.98.182.218", "206.189.127.191"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: The Aisuru IOCs include specific file hashes or registry keys that match legitimate software components from widely deployed enterprise tools like Microsoft Defender for Endpoint or CrowdStrike Falcon. For instance, a specific DLL hash associated with the Aisuru campaign might coincidentally match a version of msvcp140.dll or a similar runtime library bundled with Visual Studio Build Tools or Office 365 Click-to-Run updates.
ClickToRun.exe, msiexec.exe, or setup.exe and the file path resides under C:\Program Files\Microsoft Office\ or C:\Program Files (x86)\Microsoft Visual Studio\.Scenario: One of the Aisuru IOCs targets a specific registry key or value name (e.g., under HKLM\SOFTWARE\...) that is also used by Group Policy Objects (GPOs) or Intune Configuration Profiles during routine policy refresh cycles. Administrators using RSAT (Remote Server Administration Tools) or Intune Portal to push compliance settings may create or modify these keys, triggering the detection if the IOC is based on key existence rather than specific data values.
gpupdate.exe, svchost.exe (specifically the gpupdate service host), or IntuneConnector.exe, and the action is CreateKey or SetValue on the specific registry path.Scenario: The hunt package includes a network connection IOC (e.g., a specific IP range or domain) that overlaps with the internal IP space of a VMware vCenter Server or Hyper-V Management Console used for infrastructure monitoring. Legitimate administrative tasks, such as running **Power