This detection rule identifies potential AsyncRAT remote access trojan activity by monitoring for specific indicators of compromise such as unique process executions and network connections linked to known threat signatures. Proactively hunting for these IOCs in Azure Sentinel is critical because AsyncRAT enables adversaries to establish persistent, stealthy command-and-control channels that can facilitate data exfiltration and lateral movement before traditional alerts trigger.
Malware Family: AsyncRAT Total IOCs: 6 IOC Types: domain, ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 185[.]34[.]147[.]32:443 | botnet_cc | 2026-08-27 | 100% |
| domain | manikandan83.mysynology.net | botnet_cc | 2026-08-27 | 100% |
| ip:port | 199[.]245[.]176[.]147:7707 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 158[.]94[.]210[.]136:7707 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 105[.]159[.]4[.]49:5000 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 105[.]159[.]4[.]49:7070 | botnet_cc | 2026-08-27 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["158.94.210.136", "105.159.4.49", "185.34.147.32", "199.245.176.147"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["158.94.210.136", "105.159.4.49", "185.34.147.32", "199.245.176.147"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - AsyncRAT
let malicious_domains = dynamic(["manikandan83.mysynology.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Scenario: Legitimate deployment of the Microsoft Endpoint Configuration Manager (SCCM) or Intune management agents. These tools often utilize background processes that match the specific file hashes or network connection patterns associated with AsyncRAT’s command-and-control (C2) behavior, particularly when pushing software updates to a large fleet of workstations during business hours.
ccmexec.exe and Microsoft.Insights.Agent.exe, or filter out network traffic originating from the internal IP range of the Configuration Manager site server (e.g., 10.x.x.x) connecting to known internal update repositories.Scenario: Execution of scheduled administrative maintenance jobs using PowerShell scripts that invoke remote management tools like Sysinternals PsExec or Remote Desktop Services (RDP) listeners. These tools frequently generate network traffic and process creation events that mimic the AsyncRAT IOCs, especially when admins run bulk inventory scans or configuration audits overnight.
powershell.exe running under a specific service account (e.g., DOMAIN\svc-admin-maintenance) and the command line contains keywords like “Inventory,” “Patch,” or “Backup.” Additionally, whitelist the specific hash of the scheduled task executable if it matches known internal scripts.Scenario: Usage of enterprise remote support tools such as BeyondTrust, ConnectWise ScreenConnect, or TeamViewer for Enterprise. These applications often share similar telemetry behaviors and file signatures with AsyncRAT, leading to alerts when helpdesk technicians initiate remote sessions on user endpoints during peak operational times.