This hunt identifies the presence of AsyncRAT, a remote access trojan used by adversaries to establish persistent control and execute arbitrary commands on compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect stealthy C2 communications and unauthorized access before the malware can exfiltrate sensitive data or pivot within the network.
Malware Family: AsyncRAT Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 80[.]190[.]77[.]86:2025 | botnet_cc | 2026-09-06 | 75% |
| ip:port | 45[.]141[.]21[.]177:8808 | botnet_cc | 2026-09-06 | 75% |
| ip:port | 45[.]141[.]21[.]177:7707 | botnet_cc | 2026-09-06 | 75% |
| ip:port | 64[.]176[.]199[.]85:4404 | botnet_cc | 2026-09-06 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["45.141.21.177", "80.190.77.86", "64.176.199.85"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.141.21.177", "80.190.77.86", "64.176.199.85"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps team deploys a custom internal build agent or CI/CD runner (e.g., Jenkins, GitLab Runner, or a bespoke Python-based orchestrator) that uses asyncio for concurrent task management and maintains persistent network connections to a central coordination server. If the internal server’s IP or domain matches a known AsyncRAT C2 infrastructure (or if the agent’s binary hash coincidentally matches an IOC due to similar compilation flags), the rule may trigger.
svc-ci-runner, jenkins-agent) or exclude network connections where the destination port is a non-standard but documented internal service port (e.g., 8080, 9090) and the source process is running from a designated C:\Program Files\CI\ path.Scenario: An IT administrator performs a manual patch deployment or software distribution using a tool like PDQ Deploy, SCCM, or a custom PowerShell script that leverages System.Net.Http or async/await patterns in .NET to push updates to multiple endpoints. If the script or tool creates a temporary executable or uses a known AsyncRAT hash (e.g., due to a shared base library or similar obfuscation), it may match the IOC.
pdqdeploy.exe, DcmExec.exe, powershell.exe with specific command-line arguments containing -Deploy or -Patch) and the process owner is an admin group (e.g., DOMAIN\IT-Admins).Scenario: A security engineer or developer tests a new internal application or library that incorporates asynchronous networking features (e.g., using aiohttp in Python or async/await