This hunt targets the presence of nine known IOCs associated with the Aisuru threat actor, which may indicate an active or dormant compromise within the environment. Proactively hunting for these indicators allows the SOC to identify potential footholds or lateral movement attempts before they escalate into a full-blown incident.
Malware Family: Aisuru Total IOCs: 9 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 157[.]245[.]242[.]229:8001 | botnet_cc | 2026-09-02 | 100% |
| ip:port | 142[.]93[.]100[.]111:8001 | botnet_cc | 2026-09-02 | 100% |
| ip:port | 165[.]227[.]92[.]224:8001 | botnet_cc | 2026-09-02 | 100% |
| ip:port | 165[.]22[.]242[.]128:8001 | botnet_cc | 2026-09-02 | 100% |
| ip:port | 152[.]42[.]247[.]65:8001 | botnet_cc | 2026-09-02 | 100% |
| ip:port | 207[.]154[.]227[.]110:8001 | botnet_cc | 2026-09-02 | 100% |
| ip:port | 176[.]98[.]182[.]218:37215 | botnet_cc | 2026-09-02 | 100% |
| ip:port | 188[.]166[.]146[.]72:8443 | botnet_cc | 2026-09-02 | 100% |
| ip:port | 176[.]98[.]182[.]177:34567 | botnet_cc | 2026-09-02 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["165.227.92.224", "176.98.182.177", "207.154.227.110", "142.93.100.111", "176.98.182.218", "165.22.242.128", "152.42.247.65", "188.166.146.72", "157.245.242.229"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["165.227.92.224", "176.98.182.177", "207.154.227.110", "142.93.100.111", "176.98.182.218", "165.22.242.128", "152.42.247.65", "188.166.146.72", "157.245.242.229"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
ansible or Terraform to deploy a new web application container that includes a default configuration file (e.g., config.yaml or settings.json) matching one of the Aisuru file hashes or paths.
ansible-playbook.exe, terraform.exe, or docker.exe, and the file path resides under standard deployment directories like C:\deploy\ or /opt/app/.Nessus or Qualys on a web server, which creates temporary cache files or log artifacts in the TEMP directory that match an Aisuru IOC hash.
\TEMP\ or \tmp\ and the parent process is nessus.exe, qualys_agent.exe, or scan_manager.exe.Datadog Agent or New Relic Agent) via a scheduled GPO or SCCM task, which drops a service binary or configuration file that coincidentally matches an Aisuru IOCs.
sccmclient.exe, gpoexec.exe, or msiexec.exe, and the file path is under C:\Program Files\ or C:\Program Files (x86)\ with a known vendor folder name (e.g., Datadog, NewRelic).Veeam Backup & Replication or Commvault, which creates temporary snapshot files or log entries that match an Aisuru