ThreatFox: Aisuru IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets adversary activity linked to the Aisuru campaign by monitoring network and endpoint telemetry against a specific set of 26 Indicators of Compromise (IOCs). Proactively searching for these signals in Azure Sentinel is critical because early detection of this high-severity threat enables rapid containment before the adversary establishes persistence or exfiltrates sensitive data.

IOC Summary

Malware Family: Aisuru Total IOCs: 26 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`46[.]101[.]228[.]130:8001`	botnet_cc	2026-07-13	100%
ip:port	`209[.]97[.]129[.]135:8001`	botnet_cc	2026-07-13	100%
ip:port	`188[.]166[.]146[.]39:8001`	botnet_cc	2026-07-13	100%
ip:port	`46[.]101[.]218[.]232:8001`	botnet_cc	2026-07-13	100%
ip:port	`206[.]189[.]17[.]74:8001`	botnet_cc	2026-07-13	100%
ip:port	`206[.]189[.]119[.]212:8080`	botnet_cc	2026-07-13	100%
ip:port	`139[.]59[.]161[.]246:8080`	botnet_cc	2026-07-13	100%
ip:port	`134[.]122[.]98[.]48:8080`	botnet_cc	2026-07-13	100%
ip:port	`167[.]99[.]143[.]174:8080`	botnet_cc	2026-07-13	100%
ip:port	`165[.]232[.]71[.]140:8080`	botnet_cc	2026-07-13	100%
ip:port	`64[.]227[.]117[.]72:8080`	botnet_cc	2026-07-13	100%
ip:port	`47[.]107[.]224[.]89:8001`	botnet_cc	2026-07-13	100%
ip:port	`47[.]107[.]224[.]89:8080`	botnet_cc	2026-07-13	100%
ip:port	`144[.]124[.]239[.]18:8001`	botnet_cc	2026-07-13	100%
ip:port	`144[.]124[.]239[.]18:8080`	botnet_cc	2026-07-13	100%
ip:port	`160[.]119[.]71[.]125:8001`	botnet_cc	2026-07-13	100%
ip:port	`160[.]119[.]71[.]125:8080`	botnet_cc	2026-07-13	100%
ip:port	`78[.]153[.]136[.]26:8001`	botnet_cc	2026-07-13	100%
ip:port	`78[.]153[.]136[.]26:8080`	botnet_cc	2026-07-13	100%
ip:port	`109[.]237[.]98[.]136:8001`	botnet_cc	2026-07-13	100%
ip:port	`109[.]237[.]98[.]136:8080`	botnet_cc	2026-07-13	100%
ip:port	`103[.]214[.]146[.]46:8001`	botnet_cc	2026-07-13	100%
ip:port	`206[.]189[.]146[.]157:8080`	botnet_cc	2026-07-13	100%
ip:port	`103[.]214[.]146[.]46:8080`	botnet_cc	2026-07-13	100%
ip:port	`164[.]37[.]109[.]234:8080`	botnet_cc	2026-07-13	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["46.101.218.232", "78.153.136.26", "103.214.146.46", "109.237.98.136", "64.227.117.72", "47.107.224.89", "167.99.143.174", "209.97.129.135", "164.37.109.234", "206.189.119.212", "46.101.228.130", "134.122.98.48", "160.119.71.125", "165.232.71.140", "178.128.208.65", "206.189.17.74", "206.189.146.157", "139.59.161.246", "144.124.239.18", "188.166.146.39"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["46.101.218.232", "78.153.136.26", "103.214.146.46", "109.237.98.136", "64.227.117.72", "47.107.224.89", "167.99.143.174", "209.97.129.135", "164.37.109.234", "206.189.119.212", "46.101.228.130", "134.122.98.48", "160.119.71.125", "165.232.71.140", "178.128.208.65", "206.189.17.74", "206.189.146.157", "139.59.161.246", "144.124.239.18", "188.166.146.39"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Aisuru

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Aisuru IOCs detection rule, tailored for an enterprise environment:

Endpoint Security Agent Updates and Signature Syncs
- Scenario: The organization’s EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled daily update. During this process, the agent downloads new definition packages from a cloud repository that shares an IP address or domain with one of the Aisuru IOCs, triggering a network connection alert on multiple workstations simultaneously.
- Filter/Exclusion: Create an exclusion rule for traffic originating from specific EDR service accounts (e.g., svc-falcon-updater) connecting to known vendor update domains, or whitelist the specific IP ranges associated with the security vendor’s distribution centers if they overlap with Aisuru IOCs.
Automated Patch Management and Software Deployment
- Scenario: The IT operations team utilizes a centralized patch management tool (e.g., SCCM/MECM or Ivanti) to deploy critical OS patches on Sunday nights. The deployment server initiates outbound connections to external repositories to fetch the latest patch manifests, which may resolve to an IP address flagged as part of the Aisuru threat intelligence feed.
- Filter/Exclusion: Exclude network flows generated by the specific patch management service account (e.g., svc-sccm-dist) during defined maintenance windows (e.g., Sundays 02:00–06:00 UTC), or add the destination IP to a “Trusted Infrastructure” allowlist if it is confirmed as a legitimate software repository.
Third-Party Cloud Backup and Data Replication
- Scenario: A scheduled backup job using a tool like Veeam Backup & Replication or Commvault initiates data replication to an off-site cloud storage provider. The backup agent