ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving known AsyncRAT indicators of compromise to identify potential remote access trojan infections within the Azure Sentinel environment. Proactively hunting for these specific IOCs is critical because AsyncRAT’s ability to execute arbitrary commands and exfiltrate data makes early detection essential for mitigating high-severity lateral movement risks before they escalate into full-scale breaches.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["69.10.49.136", "89.144.10.64", "3.127.138.57"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["69.10.49.136", "89.144.10.64", "3.127.138.57"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: AsyncRAT IOCs detection rule in an enterprise environment:

• Endpoint Security Agent Updates & Scans

  • Scenario: The organization’s Endpoint Detection and Response (EDR) solution, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs a scheduled definition update or on-demand scan. These agents often download large payload files containing hash signatures that match the AsyncRAT IOCs (specifically generic DLLs or PE headers used in legitimate security tools).
  • Suggested Filter: Exclude file hashes and process paths associated with the EDR vendor’s installation directory (e.g., C:\Program Files\CrowdStrike\* or C:\Windows\System32\Microsoft Defender Antivirus\*) and exclude events where the parent process is the specific security service executable (e.g., csagent.exe, MsMpEng.exe).

• Software Deployment via Configuration Management

  • Scenario: An IT Operations team uses Ansible, SCCM (Microsoft Endpoint Configuration Manager), or Chef to deploy a new application update. During the deployment, the automation tool extracts compressed archives containing legitimate binaries that share cryptographic hashes with known AsyncRAT components. This often occurs during off-hours maintenance windows where large file transfers are common.
  • Suggested Filter: Create an exclusion based on the “User Account” field to whitelist service accounts used for automation (e.g., svc_ansible_deploy, SCCM_System_Account) and exclude events originating from known deployment workstations or management servers identified by their IP ranges.

• Third-Party Remote Support Sessions

  • Scenario: A helpdesk technician initiates a remote support session using tools like TeamViewer, AnyDesk, or Splashtop. These applications frequently inject