ThreatFox: Aisuru IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity linked to the Aisuru malware campaign by searching for four specific Indicators of Compromise (IOCs) across network and endpoint telemetry within Azure Sentinel. Proactively hunting for these signatures is critical because early identification of this high-severity threat enables the SOC team to rapidly isolate affected assets and mitigate potential data exfiltration before lateral expansion occurs.

IOC Summary

Malware Family: Aisuru Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`149[.]28[.]158[.]66:9034`	botnet_cc	2026-07-18	100%
ip:port	`206[.]189[.]144[.]140:12345`	botnet_cc	2026-07-18	100%
ip:port	`159[.]203[.]1[.]105:5555`	botnet_cc	2026-07-18	100%
ip:port	`45[.]77[.]168[.]73:8443`	botnet_cc	2026-07-18	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["159.203.1.105", "45.77.168.73", "206.189.144.140", "149.28.158.66"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["159.203.1.105", "45.77.168.73", "206.189.144.140", "149.28.158.66"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Aisuru

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Aisuru IOCs detection rule, tailored for an enterprise environment:

Endpoint Protection Policy Deployment via Microsoft Intune
- Scenario: The enterprise security team pushes a new policy update to the endpoint management agent (e.g., CrowdStrike or SentinelOne) using Microsoft Intune. This deployment triggers a background service that downloads and executes a configuration script containing Aisuru-related hash values or certificate chains, which are part of the vendor’s standard software supply chain but not yet whitelisted in the threat intelligence feed.
- Filter/Exclusion: Create an exclusion rule for processes running under the Microsoft Intune Management Extension service account (e.g., NT SERVICE\IntuneManagementExtension) or specifically exclude the executable path C:\Program Files\Microsoft Intune Management Extension\*.
Scheduled Vulnerability Scan by Qualys Agent
- Scenario: A nightly scheduled job runs the Qualys Cloud Agent to perform a vulnerability assessment. During the scan, the agent queries local registry keys and file systems for known software signatures. The scan process inadvertently flags the presence of Aisuru IOCs (such as specific DLLs or network connections) within the “Software Inventory” module, interpreting them as active threats rather than benign inventory data.
- Filter/Exclusion: Exclude alerts generated by the QualysAgent service running under the SYSTEM account during the defined maintenance window (e.g., 02:00–04:00 UTC). Additionally, filter out network connections originating from the Qualys agent’s specific process ID.
Automated Patch Management via SCCM/MECM
- Scenario: The System Center Configuration Manager (SCCM) executes a scheduled software update task for third-party applications. This task invokes a PowerShell script that validates digital