This hunt detects adversary activity involving the AsyncRAT remote access tool by identifying specific indicators of compromise such as unique process executions and network connections. Proactively hunting for these signals in Azure Sentinel is critical to uncover early-stage lateral movement or command-and-control communications that may evade standard signature-based detections.
Malware Family: AsyncRAT Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 80[.]190[.]77[.]86:8808 | botnet_cc | 2026-08-20 | 100% |
| ip:port | 80[.]190[.]77[.]86:1000 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 80[.]190[.]77[.]86:8008 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 104[.]243[.]248[.]63:84 | botnet_cc | 2026-08-20 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["80.190.77.86", "104.243.248.63"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["80.190.77.86", "104.243.248.63"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:
Scenario: Legitimate Remote Administration via Microsoft Endpoint Manager (Intune)
Microsoft.IntuneManagementExtension) frequently establish connections to update endpoints or push configurations that match these IOCs.ProcessName is IntuneManagementService.exe and the parent process is CmService.exe. Additionally, filter out traffic originating from the corporate IP range if the destination matches the known Intune update server domain (e.g., *.manage.microsoft.com).Scenario: Scheduled Backup Jobs Using Veeam or Commvault
Veeam.Backup.Service.exe might trigger the rule when it initiates a connection to the backup repository, matching the IOCs for command-and-control traffic or specific executable hashes.Scheduled Task Name. If the event source is linked to tasks named “VeeamBackup” or “CommvaultAgent”, suppress the alert. Alternatively, exclude any process running under the service account DOMAIN\BackupServiceAccount during defined maintenance windows (e.g., 02:00 – 06:00).Scenario: Software Deployment via SCCM/MECM Client
ccmexec.exe) frequently downloads application updates and scripts. If the AsyncRAT IO