ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt detects adversary behavior consistent with AsyncRAT malware by identifying network and host activities matching five specific Indicators of Compromise (IOCs). Proactively hunting for these signals in Azure Sentinel is critical to rapidly identify and contain potential remote access trojan infections before they establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`207[.]180[.]250[.]181:10900`	botnet_cc	2026-07-10	75%
ip:port	`147[.]124[.]218[.]54:62025`	botnet_cc	2026-07-10	75%
ip:port	`104[.]250[.]161[.]126:2061`	botnet_cc	2026-07-10	75%
ip:port	`13[.]53[.]169[.]83:5000`	botnet_cc	2026-07-10	100%
ip:port	`146[.]19[.]248[.]64:8808`	botnet_cc	2026-07-10	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["207.180.250.181", "147.124.218.54", "13.53.169.83", "104.250.161.126", "146.19.248.64"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["207.180.250.181", "147.124.218.54", "13.53.169.83", "104.250.161.126", "146.19.248.64"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Endpoint Protection Scanning of Known Malware Definitions
- Scenario: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled definition update and subsequent full scan. During this process, the EDR agent downloads and extracts known malware samples from the vendor’s repository to verify detection signatures. If AsyncRAT is included in these test samples or historical threat libraries, the extraction of its specific IOCs (hashes or network connections) will trigger the rule even though no actual infection exists on the host.
- Filter/Exclusion: Exclude processes originating from the EDR vendor’s installation directory (e.g., C:\Program Files\CrowdStrike\ or C:\ProgramData\Microsoft\Windows Defender\) and filter out network connections where the destination IP belongs to the EDR vendor’s update server ranges.
IT Security Team Manual Threat Hunting Exercises
- Scenario: The internal Blue Team conducts a monthly “Red Team” simulation or manual threat hunting exercise using a dedicated sandbox environment (e.g., Cylance Optics or a custom VM lab). Analysts intentionally deploy the AsyncRAT payload to test detection latency and response procedures. Since these simulations run on production network segments, the IOCs generated by the controlled deployment match the rule’s criteria exactly, appearing as live threats rather than drills.
- Filter/Exclusion: Create an exclusion based on specific hostnames or IP subnets designated for “Security Labs” or “Sandbox Environments.” Additionally, tag events with a custom metadata attribute (e.g., Event_Type = "Simulation") to bypass alerting during scheduled maintenance windows.
**Software Deployment via Configuration