ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hypothesis targets the presence of AsyncRAT, a remote access trojan that grants adversaries persistent control to exfiltrate data and execute commands, by correlating its known indicators of compromise against Azure Sentinel telemetry. Proactively hunting for these IOCs is critical because AsyncRAT often operates stealthily to maintain long-term access, allowing attackers to pivot through internal networks before traditional detection mechanisms trigger an alert.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 9 IOC Types: ip:port, sha1_hash, md5_hash, sha256_hash, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["212.43.153.129", "172.111.232.18", "38.247.165.127", "91.92.42.16", "80.190.77.86"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["212.43.153.129", "172.111.232.18", "38.247.165.127", "91.92.42.16", "80.190.77.86"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - AsyncRAT
let malicious_domains = dynamic(["pw.sonqhong.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - AsyncRAT
let malicious_hashes = dynamic(["56309608ad8e762d1ca1e8287ee5271f", "7aaee32a94cf4a6b40140221bdef3b10de5620cd3ff2f41ff0710d31c9302545", "1e8a2d8a27607c7a8c19f321ce2fe48001604fa6"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

• Legitimate Remote Support Sessions: IT support teams using commercial remote access tools (e.g., TeamViewer, AnyDesk, or LogMeIn) may leave residual processes or temporary files that match AsyncRAT’s known IOCs, particularly if the tool uses similar naming conventions for its helper executables or configuration files.
  • Filter/Exclusion: Exclude processes originating from known vendor directories (e.g., C:\Program Files\TeamViewer\) and filter out events where the parent process is a recognized support agent.
• Developer Testing Environments: Developers or QA engineers running local instances of AsyncRAT for penetration testing or malware analysis in isolated lab environments (e.g., Hyper-V VMs or Docker containers) may trigger detections if the IOCs are not properly sandboxed or if the test environment is not tagged in the EDR.
  • Filter/Exclusion: Exclude hosts tagged with Environment=Lab or Role=Dev-Test in the asset inventory, or filter based on the process path containing /test/ or /lab/ directories.
• Scheduled Maintenance Scripts: Automated maintenance jobs (e.g., PowerShell scripts or batch files) that clean up temporary files or rotate logs might inadvertently create or modify files with names matching AsyncRAT’s dropped configuration files (e.g., config.ini or settings.dat) in standard temp directories.
  • Filter/Exclusion: Exclude file creation/modification events in C:\Windows\Temp\ or %TEMP% where the parent process is a known system service (e.g., svchost.exe, powershell.exe launched by Task Scheduler) and the file size is below a certain threshold (e.g., < 1KB).
• Third-Party Application Updates: Some third-party applications (e.g., Adobe Creative Cloud, Java Runtime Environment) install or update helper