This hunt targets adversary activity linked to the Aisuru threat actor by monitoring for specific indicators of compromise across network and endpoint logs within Azure Sentinel. Proactively hunting these seven high-severity IOCs is critical to identify early-stage intrusions and mitigate potential data exfiltration before the attacker establishes persistence in the environment.
Malware Family: Aisuru Total IOCs: 7 IOC Types: ip:port, sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 120[.]205[.]80[.]152:8080 | botnet_cc | 2026-07-09 | 100% |
| ip:port | 159[.]203[.]1[.]105:34567 | botnet_cc | 2026-07-09 | 100% |
| ip:port | 120[.]205[.]80[.]152:9034 | botnet_cc | 2026-07-09 | 100% |
| ip:port | 217[.]60[.]195[.]155:80 | botnet_cc | 2026-07-09 | 75% |
| ip:port | 217[.]60[.]195[.]155:4444 | payload_delivery | 2026-07-09 | 75% |
| sha256_hash | 15f446470be5c470e41b42b8d18f36c10cb6efbac3c69f1f7fd21a1496e4a7a6 | payload | 2026-07-09 | 75% |
| ip:port | 152[.]42[.]214[.]91:8080 | botnet_cc | 2026-07-09 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["217.60.195.155", "152.42.214.91", "120.205.80.152", "159.203.1.105"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["217.60.195.155", "152.42.214.91", "120.205.80.152", "159.203.1.105"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - Aisuru
let malicious_hashes = dynamic(["15f446470be5c470e41b42b8d18f36c10cb6efbac3c69f1f7fd21a1496e4a7a6"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceFileEvents | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: Aisuru IOCs detection rule, tailored for an enterprise environment:
Endpoint Security Agent Self-Updates
md5 of a known legitimate library component used in the agent’s communication module.C:\Program Files\CrowdStrike\fsagent.exe) and restrict the alert to only trigger if the process is running under a non-system user context or outside of standard maintenance windows (02:00–04:00 UTC).Scheduled Vulnerability Scanning Jobs
qualysagent.exe or tenable-agent.exe and the command line arguments include flags like -scan-type=inventory.Software Deployment via Configuration Management Tools