ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving the AsyncRAT remote access tool by monitoring for specific indicators of compromise such as unique process executions and network connections. A SOC team should proactively hunt for these signals in Azure Sentinel to rapidly detect and contain potential lateral movement or data exfiltration campaigns driven by this sophisticated RAT before they escalate into broader incidents.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["145.63.130.104", "169.58.180.142", "86.48.16.94"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["145.63.130.104", "169.58.180.142", "86.48.16.94"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

Here are specific false positive scenarios and corresponding filters/exclusions for the ThreatFox: AsyncRAT IOCs detection rule in an enterprise environment:

• Scenario: Scheduled Endpoint Protection Updates via Admin Service Accounts

  • Context: Enterprise security suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) often run automated update jobs under high-privilege service accounts. These processes may spawn child processes or network connections that match AsyncRAT’s known IOCs (specifically hash signatures or registry keys used by the malware) due to overlapping software components or shared DLLs.
  • Filter/Exclusion: Create a rule exclusion for specific Service Account names (e.g., DOMAIN\EP-UpdateSvc) and process paths matching the security vendor’s installation directory (e.g., C:\Program Files\CrowdStrike\FalconSensor\). Additionally, exclude alerts occurring during defined maintenance windows (e.g., 02:00–04:00 UTC).

• Scenario: Legitimate Remote Management Tools Deployed by IT Operations

  • Context: IT teams frequently deploy remote management agents like BeyondTrust, TeamViewer, or AnyDesk for helpdesk support. These tools often utilize similar communication protocols and registry modifications that mimic AsyncRAT’s behavior, particularly when establishing persistent connections to central management servers using specific ports or certificate hashes.
  • Filter/Exclusion: Implement a whitelist based on the Image Path of known remote management binaries (e.g., C:\Program Files\TeamViewer\TeamViewer.exe) and exclude network traffic originating from these processes to known internal management subnets (e.g., 10.50.x.x).

• Scenario: Software Deployment via Configuration Management Platforms

  • Context: During mass software deployments using tools like Microsoft SCCM, Ivanti, or