ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hypothesis targets the presence of known AsyncRAT indicators, which are frequently used by adversaries to establish persistent remote access and execute malicious commands on compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify and contain active AsyncRAT infections before they can be leveraged for lateral movement or data exfiltration.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`94[.]154[.]32[.]104:8808`	botnet_cc	2026-09-15	75%
ip:port	`82[.]26[.]66[.]136:8808`	botnet_cc	2026-09-15	75%
ip:port	`46[.]40[.]228[.]158:1723`	botnet_cc	2026-09-15	75%
ip:port	`194[.]26[.]192[.]153:4441`	botnet_cc	2026-09-15	75%
ip:port	`185[.]249[.]199[.]108:1178`	botnet_cc	2026-09-15	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["194.26.192.153", "94.154.32.104", "185.249.199.108", "46.40.228.158", "82.26.66.136"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["194.26.192.153", "94.154.32.104", "185.249.199.108", "46.40.228.158", "82.26.66.136"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

Scenario: A DevOps engineer uses Ansible or Terraform to provision a new Windows Server instance, where the initialization script downloads a lightweight utility (e.g., 7z.exe or curl.exe) from a public CDN or internal artifact repository that happens to share the same SHA256 hash or file path as an AsyncRAT IOC.
- Filter/Exclusion: Exclude alerts where the parent process is ansible-playbook.exe, terraform.exe, or powershell.exe initiated by a service account, and the file location is within standard build directories like C:\Temp\builds\ or C:\Artifacts\.
Scenario: An IT administrator runs a scheduled Group Policy Object (GPO) software distribution job that pushes a specific version of WinRAR or 7-Zip to endpoint machines. The distributed executable matches a known AsyncRAT IOCs due to a shared build artifact or a generic filename like update.exe in a non-standard directory.
- Filter/Exclusion: Exclude alerts where the file path contains \GPO\ or \SoftwareDistribution\, and the parent process is gpupdate.exe or svchost.exe (Group Policy Client service), ensuring the file was created by a domain admin account.
Scenario: A security team deploys a CrowdStrike Falcon or Carbon Black sensor update via a custom PowerShell script that temporarily downloads a helper binary (e.g., csagent_helper.exe) to a temporary folder (%TEMP%) before installation. This binary’s hash or path coincides with an AsyncRAT IOC.
- Filter/Exclusion: Exclude alerts where the file resides in %TEMP% or %LOCALAPPDATA%\Temp and the parent process is powershell.exe or `pw