ThreatFox: Aisuru IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity by identifying network traffic and endpoint events matching three specific Indicators of Compromise (IOCs) linked to the Aisuru threat actor. Proactively hunting for these IOCs in Azure Sentinel is critical because Aisuru represents a high-severity threat that often targets cloud environments, allowing the SOC team to rapidly isolate compromised assets before lateral movement occurs.

IOC Summary

Malware Family: Aisuru Total IOCs: 3 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`159[.]89[.]24[.]55:9035`	botnet_cc	2026-08-25	100%
ip:port	`168[.]144[.]188[.]31:8080`	botnet_cc	2026-08-25	100%
ip:port	`64[.]227[.]187[.]82:34567`	botnet_cc	2026-08-25	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["159.89.24.55", "64.227.187.82", "168.144.188.31"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["159.89.24.55", "64.227.187.82", "168.144.188.31"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Aisuru

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Aisuru IOCs detection rule, including targeted filters and exclusions:

Endpoint Detection & Response (EDR) Signature Updates
- Scenario: The enterprise EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) automatically downloads and installs threat intelligence feeds that include Aisuru’s known good IOCs. When the EDR agent processes these updates, it may generate network traffic or file hash events matching the rule’s hunt criteria, triggering a false alert.
- Filter/Exclusion: Exclude process names related to the EDR service (e.g., FalconService.exe, MsMpEng.exe) and filter out events where the source IP belongs to the internal update server subnet or the specific vendor’s CDN range.
Scheduled Vulnerability Scanning Jobs
- Scenario: A nightly scheduled job using a vulnerability management tool (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) runs against the corporate network. These scanners often probe external threat intelligence APIs to cross-reference asset data, generating traffic patterns that match the Aisuru IOCs defined in the hunt package.
- Filter/Exclusion: Create an exclusion for events occurring during the defined maintenance window (e.g., 02:00–04:00 UTC) where the source process is Nessus.exe or QualysPCAgent, and the destination port corresponds to standard scanning ports (80, 443, or specific API ports used by Aisuru).
Cloud Security Posture Management (CSPM) Data Ingestion
- Scenario: The organization utilizes a cloud security platform (e.g., Prisma Cloud, Wiz, or Lacework) that ingests threat intelligence data from third-party providers.