This detection rule identifies active AsyncRAT remote access trojan infections by monitoring for seven specific indicators of compromise known to facilitate command-and-control communication and lateral movement. Proactively hunting for these IOCs in Azure Sentinel is critical because AsyncRAT’s ability to execute arbitrary commands and exfiltrate sensitive data allows adversaries to establish persistent footholds that often evade standard signature-based defenses.
Malware Family: AsyncRAT Total IOCs: 7 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 193[.]161[.]193[.]99:35711 | botnet_cc | 2026-08-16 | 75% |
| ip:port | 172[.]93[.]144[.]140:8580 | botnet_cc | 2026-08-15 | 100% |
| ip:port | 185[.]34[.]147[.]35:6606 | botnet_cc | 2026-08-15 | 75% |
| ip:port | 185[.]34[.]147[.]33:6606 | botnet_cc | 2026-08-15 | 75% |
| ip:port | 185[.]34[.]147[.]34:6606 | botnet_cc | 2026-08-15 | 75% |
| ip:port | 185[.]34[.]147[.]32:6606 | botnet_cc | 2026-08-15 | 75% |
| ip:port | 185[.]34[.]147[.]31:6606 | botnet_cc | 2026-08-15 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["172.93.144.140", "185.34.147.32", "185.34.147.35", "185.34.147.34", "193.161.193.99", "185.34.147.31", "185.34.147.33"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["172.93.144.140", "185.34.147.32", "185.34.147.35", "185.34.147.34", "193.161.193.99", "185.34.147.31", "185.34.147.33"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule, including context and suggested filters:
Scenario: Legitimate Remote Administration via Microsoft SCCM/Intune
ccmexec.exe (SCCM Client) or Microsoft.IntuneManagementAgent.exe, and the destination IP belongs to the organization’s internal management subnet.Scenario: Scheduled Backup Jobs Using Veeam or Commvault
Veeam.Backup.Service.exe or commvault.cmd, provided the destination IP is a known backup repository server.Scenario: IT Helpdesk Remote Support Sessions (TeamViewer/AnyDesk)