ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt targets the presence of AsyncRAT indicators of compromise, which are frequently leveraged by adversaries to establish persistent remote access and execute command-and-control operations. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints early, mitigating the risk of data exfiltration or lateral movement before the malware fully integrates into the environment.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 3 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`83[.]136[.]210[.]2:6666`	botnet_cc	2026-09-28	75%
ip:port	`80[.]190[.]77[.]86:20400`	botnet_cc	2026-09-28	75%
ip:port	`36[.]255[.]97[.]47:7707`	botnet_cc	2026-09-28	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["83.136.210.2", "36.255.97.47", "80.190.77.86"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["83.136.210.2", "36.255.97.47", "80.190.77.86"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

Scenario: A DevOps engineer deploys a custom Python-based automation script to manage cloud infrastructure, which includes a socket connection to an internal staging server using a non-standard port (e.g., 8443) and a specific User-Agent string that matches one of the AsyncRAT IOCs.
- Filter/Exclusion: Exclude processes named python.exe or python3.exe where the parent process is cmd.exe or powershell.exe and the destination IP is within the corporate internal subnet range (e.g., 10.0.0.0/8).
Scenario: An IT administrator runs a legacy Java-based backup utility that establishes an outbound TCP connection to a specific external IP address (e.g., 203.0.113.45) on port 443, where the User-Agent string or certificate fingerprint coincidentally matches an AsyncRAT IOC due to shared library versions.
- Filter/Exclusion: Exclude processes named java.exe or jre.exe where the destination IP is in the known external service list (e.g., AWS S3, Azure Blob) and the process path is located in the standard Java installation directory (e.g., C:\Program Files\Java\...).
Scenario: A QA team executes a load-testing tool (e.g., JMeter or Gatling) that generates high-volume HTTP requests to a test endpoint, where the generated traffic pattern or specific header values (e.g., X-Async-RAT-Test) trigger the IOC match due to overlapping string patterns.
- Filter/Exclusion: Exclude processes named java.exe or node.exe where the parent process is cmd.exe and the command-line arguments contain keywords like -test, -load, or -benchmark.
Scenario: A