ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior where malicious actors deploy AsyncRAT remote access trojans to establish persistence and exfiltrate sensitive data via specific known indicators of compromise. Proactively hunting for these six IOCs within Azure Sentinel is critical because early detection of this high-severity threat prevents lateral movement and minimizes the window for potential data breaches before automated alerts trigger.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 6 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`104[.]164[.]46[.]36:4449`	botnet_cc	2026-07-09	75%
ip:port	`104[.]164[.]46[.]36:2026`	botnet_cc	2026-07-09	75%
ip:port	`91[.]219[.]238[.]167:6745`	botnet_cc	2026-07-09	75%
ip:port	`37[.]72[.]172[.]58:6606`	botnet_cc	2026-07-09	75%
ip:port	`157[.]20[.]182[.]17:7707`	botnet_cc	2026-07-09	75%
ip:port	`157[.]20[.]182[.]18:7707`	botnet_cc	2026-07-09	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["37.72.172.58", "104.164.46.36", "157.20.182.17", "157.20.182.18", "91.219.238.167"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["37.72.172.58", "104.164.46.36", "157.20.182.17", "157.20.182.18", "91.219.238.167"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule, including suggested filters or exclusions tailored for an enterprise environment:

Legitimate Software Deployment via SCCM/MECM
- Scenario: The IT Operations team deploys a new version of “AsyncRAT” (or a similarly named utility) to the engineering workstations using Microsoft Endpoint Configuration Manager (MECM). This triggers network connections and file hash matches against the AsyncRAT IOCs during the installation phase, particularly when the agent communicates with the central management point.
- Filter/Exclusion: Create an exclusion rule for traffic originating from the specific IP range of the SCCM Distribution Points or filter alerts where the source process is ccmexec.exe (the MECM client service) initiating connections to known internal management subnets.
Scheduled Backup and Patching Jobs
- Scenario: A nightly scheduled task runs a custom PowerShell script named AsyncRAT_HealthCheck.ps1 on domain controllers to verify agent status before the weekly patch cycle begins. This script queries external threat intelligence feeds, generating network flows that match the AsyncRAT IOCs (specifically DNS lookups and HTTPS connections).
- Filter/Exclusion: Exclude alerts where the source process is powershell.exe or svchost.exe running under the specific service account svc-patching-admin during the defined maintenance window (e.g., Sundays 02:00–04:00 UTC).
Third-Party Remote Support Sessions
- Scenario: The Help Desk utilizes a third-party remote support tool (such as TeamViewer or AnyDesk) which internally uses an “AsyncRAT” module for session logging and telemetry. When a Level 2 support engineer initiates a remote session to troubleshoot a server,