This hunt detects adversary behavior involving the deployment of AsyncRAT remote access trojans by monitoring network and endpoint telemetry against a curated set of 16 specific indicators of compromise. A SOC team should proactively hunt for these IOCs in Azure Sentinel to identify early-stage lateral movement and command-and-control activities that often evade standard signature-based detections due to their dynamic nature.
Malware Family: AsyncRAT Total IOCs: 16 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 195[.]177[.]94[.]101:110 | botnet_cc | 2026-09-01 | 100% |
| ip:port | 185[.]99[.]135[.]19:443 | botnet_cc | 2026-09-01 | 100% |
| ip:port | 80[.]190[.]77[.]86:20800 | botnet_cc | 2026-09-01 | 75% |
| ip:port | 64[.]177[.]41[.]198:6666 | botnet_cc | 2026-09-01 | 75% |
| ip:port | 217[.]217[.]97[.]164:7707 | botnet_cc | 2026-09-01 | 75% |
| ip:port | 217[.]217[.]97[.]164:53 | botnet_cc | 2026-09-01 | 75% |
| ip:port | 128[.]90[.]135[.]59:4444 | botnet_cc | 2026-09-01 | 75% |
| ip:port | 105[.]158[.]184[.]163:5000 | botnet_cc | 2026-09-01 | 75% |
| ip:port | 105[.]158[.]184[.]163:5001 | botnet_cc | 2026-09-01 | 75% |
| ip:port | 102[.]220[.]160[.]198:5333 | botnet_cc | 2026-09-01 | 75% |
| ip:port | 202[.]162[.]99[.]199:7878 | botnet_cc | 2026-09-01 | 75% |
| ip:port | 118[.]107[.]1[.]203:7878 | botnet_cc | 2026-09-01 | 75% |
| ip:port | 103[.]45[.]66[.]107:7878 | botnet_cc | 2026-09-01 | 75% |
| ip:port | 118[.]107[.]16[.]32:7878 | botnet_cc | 2026-09-01 | 75% |
| ip:port | 195[.]177[.]94[.]101:8080 | botnet_cc | 2026-09-01 | 100% |
| ip:port | 102[.]220[.]160[.]198:5222 | botnet_cc | 2026-09-01 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["118.107.1.203", "217.217.97.164", "128.90.135.59", "185.99.135.19", "102.220.160.198", "105.158.184.163", "103.45.66.107", "195.177.94.101", "202.162.99.199", "118.107.16.32", "80.190.77.86", "64.177.41.198"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["118.107.1.203", "217.217.97.164", "128.90.135.59", "185.99.135.19", "102.220.160.198", "105.158.184.163", "103.45.66.107", "195.177.94.101", "202.162.99.199", "118.107.16.32", "80.190.77.86", "64.177.41.198"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding filters/exclusions for the ThreatFox: AsyncRAT IOCs detection rule in an enterprise environment:
Scenario: A DevOps engineer runs a containerized build pipeline using Jenkins or GitLab CI, which executes a custom PowerShell script to deploy artifacts. The script includes a New-Object System.Net.WebClient call to fetch a configuration manifest from an internal repository URL that matches the AsyncRAT C2 domain pattern, triggering the network connection IOC.
java.exe (Jenkins) or gitlab-runner.exe, and the destination IP belongs to the internal corporate subnet range (e.g., 10.x.x.x or 192.168.x.x).Scenario: The IT Operations team utilizes a scheduled task named “Daily Asset Inventory” running via Microsoft Endpoint Configuration Manager (SCCM) or PDQ Deploy. This job executes a background agent that queries an internal asset management API, generating a specific registry key modification (HKLM\Software\AsyncRAT or similar) and a file hash match against the AsyncRAT IOCs due to overlapping naming conventions in the enterprise toolset.
ProcessName is ccmexec.exe, pdqagent.exe, or wuauserv.exe, and the event timestamp falls within the defined maintenance window (e.g., 02:00 – 04:00 local time).Scenario: The Security Operations Center deploys a new version of an internal RMM (Remote Monitoring and Management) tool, such as NinjaOne or Lansweeper, which installs a background service. This service establishes persistent outbound HTTPS connections to the vendor’s update