ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior characterized by network connections to known AsyncRAT infrastructure, indicating potential remote access trojan deployment or command-and-control communication. Proactively hunting these specific indicators in Azure Sentinel is critical to identify early-stage compromises before the malware establishes persistence and exfiltrates sensitive data from the environment.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 7 IOC Types: ip:port, md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
ip:port	`172[.]94[.]18[.]103:70`	botnet_cc	2026-07-02	75%
md5_hash	`179e5c88bbd34e45830e7ee3610d5216`	payload	2026-07-02	95%
sha256_hash	`0aac658075b7d9e81419d0beaa3db796569bc14fd57512f4479fb36e9cc4c1a2`	payload	2026-07-02	95%
sha1_hash	`e6fa8fda487392419be240e2911e7c9c346b750c`	payload	2026-07-02	95%
md5_hash	`538860d455edc8108e667b8498a41fe3`	payload	2026-07-02	95%
sha256_hash	`fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9`	payload	2026-07-02	95%
sha1_hash	`6bbb36dc96230667e363d62881a6166ec67b8a89`	payload	2026-07-02	95%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["172.94.18.103"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["172.94.18.103"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - AsyncRAT
let malicious_hashes = dynamic(["179e5c88bbd34e45830e7ee3610d5216", "0aac658075b7d9e81419d0beaa3db796569bc14fd57512f4479fb36e9cc4c1a2", "e6fa8fda487392419be240e2911e7c9c346b750c", "538860d455edc8108e667b8498a41fe3", "fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9", "6bbb36dc96230667e363d62881a6166ec67b8a89"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceFileEvents`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Endpoint Protection Scanning of Quarantine Archives
- Scenario: The EDR agent (e.g., CrowdStrike Falcon or Microsoft Defender) performs a deep scan on the C:\ProgramData\ThreatFox\Quarantine directory. This action triggers file creation and network beaconing events that match AsyncRAT’s known IOCs, specifically when the scanner extracts a sample containing similar hash signatures to the AsyncRAT payload for analysis.
- Filter/Exclusion: Exclude processes originating from the EDR service accounts (e.g., svc-crowdstrike, LocalSystem running MsMpEng.exe) and restrict detection scope to exclude file paths under C:\ProgramData\ThreatFox\Quarantine.
Scheduled Software Deployment via SCCM/Intune
- Scenario: A nightly scheduled task managed by Microsoft Endpoint Configuration Manager (SCCM) or Intune deploys a new version of the “AsyncRAT” monitoring agent to the workforce. During this deployment, the installer (msiexec.exe spawning AsyncRAT_Installer.exe) generates network connections and file modifications that mimic the initial execution behavior of the actual malware.
- Filter/Exclusion: Create a whitelist for the specific Installer Hash (SHA256) used in the deployment package and exclude network traffic originating from the SCCM Management Point IP ranges during standard maintenance windows (e.g., 01:00–04:00 UTC).
IT Admin Manual Remediation Scripts
- Scenario: An IT administrator runs a PowerShell script (Remediate_RemoteAccess.ps1) to audit and update remote access configurations on a batch of servers