ThreatFox: Aisuru IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets adversary activity involving specific Indicators of Compromise (IOCs) linked to the Aisuru threat, which may indicate early-stage reconnaissance or lateral movement within the network. Proactively hunting for these signatures in Azure Sentinel is critical because Aisuru’s high-severity profile suggests a sophisticated actor capable of exploiting cloud-specific vulnerabilities before traditional alerts trigger.

IOC Summary

Malware Family: Aisuru Total IOCs: 6 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`138[.]197[.]155[.]246:12345`	botnet_cc	2026-07-07	100%
ip:port	`159[.]203[.]35[.]164:34567`	botnet_cc	2026-07-07	100%
ip:port	`157[.]245[.]59[.]180:5555`	botnet_cc	2026-07-07	100%
ip:port	`159[.]203[.]35[.]164:12345`	botnet_cc	2026-07-07	100%
ip:port	`138[.]197[.]155[.]246:9035`	botnet_cc	2026-07-07	100%
ip:port	`159[.]203[.]35[.]164:37215`	botnet_cc	2026-07-07	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["159.203.35.164", "138.197.155.246", "157.245.59.180"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["159.203.35.164", "138.197.155.246", "157.245.59.180"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Aisuru

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Aisuru IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Scheduled Security Scans by Endpoint Protection Agents
- Scenario: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) performs a daily scheduled scan of the C:\ProgramData\Aisuru directory. During this process, the agent generates network connections to internal threat intelligence feeds that match Aisuru IOCs, or reads files containing embedded hashes that trigger the hunt package.
- Filter/Exclusion: Exclude traffic originating from the specific Service Accounts used by these EDR agents (e.g., svc_defender_scan) and restrict the rule scope to exclude the known IP ranges of internal threat intelligence update servers.
Patch Management Deployments via Configuration Tools
- Scenario: A weekly patching cycle managed by Ansible, SCCM (Microsoft Endpoint Configuration Manager), or Chef deploys a security configuration package that includes Aisuru-related scripts or certificates. The deployment agent establishes connections to the internal artifact repository, triggering the detection logic as it downloads and validates these specific IOCs across multiple workstations simultaneously.
- Filter/Exclusion: Create an exclusion for hosts tagged with the Patch-Window attribute during the defined maintenance window (e.g., Sundays 02:00–06:00 UTC) or whitelist the IP addresses of the configuration management servers and artifact repositories.
Automated Compliance Auditing Scripts
- Scenario: An internal compliance team runs a PowerShell script using PowerShell Desired State Configuration (DSC) to verify the integrity of critical security tools. This script queries the Aisuru installation directory, checking file hashes against