ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving AsyncRAT remote access trojan indicators that enable persistent command-and-control communication and sensitive data exfiltration. Proactively hunting for these specific IOCs in Azure Sentinel is critical to identify early-stage compromises before attackers establish deep footholds within the enterprise network.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["45.131.182.88", "104.243.248.63"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.131.182.88", "104.243.248.63"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Endpoint Protection Scans Triggering Hash Matches

  • Context: Enterprise antivirus solutions (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently download definition updates or scan specific artifacts that share a known hash with AsyncRAT. This often occurs during scheduled nightly scans where the AV engine extracts and analyzes a library file identical to one flagged in the ThreatFox feed.
  • Filter/Exclusion: Exclude processes originating from trusted security vendors by filtering on ProcessName containing “CrowdStrike”, “DefenderService”, or “Windows Defender”. Additionally, add a logic check where if the parent process is MsMpEng.exe or FalconSensor.exe, the alert is suppressed.

• Scenario: Scheduled PowerShell Deployment of Internal Tools

  • Context: The IT Operations team runs scheduled jobs (via Task Scheduler) to deploy internal management agents using PowerShell scripts (powershell.exe). These scripts often load a specific shared DLL or executable that matches an AsyncRAT IOC hash. This is common when rolling out new monitoring tools across the domain during maintenance windows.
  • Filter/Exclusion: Create an exclusion based on ScriptBlock content or command line arguments containing internal keywords like “InternalDeploy” or “PatchManagement”. Alternatively, whitelist specific Task Scheduler tasks (e.g., Microsoft\Windows\UpdateOrchestration) that are known to execute these scripts.

• Scenario: Remote Administration via RDP or SSH

  • Context: System Administrators performing remote maintenance often launch the AsyncRAT client tool manually from a shared network drive (\\FileServer\AdminTools\AsyncRAT.exe) for troubleshooting purposes. Since this is a legitimate administrative action, the detection