ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving AsyncRAT remote access trojan indicators to identify potential command and control communications or lateral movement within the network. A SOC team should proactively search for these IOCs in Azure Sentinel because AsyncRAT is a sophisticated tool frequently used by threat actors to establish persistent footholds and exfiltrate sensitive data, requiring early detection to mitigate advanced threats.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`66a1dfb08cb48494a16f60ecc6a827acb02388ddd364baafad3cc9774fcaae2d`	payload	2026-08-25	95%
sha1_hash	`eddfa48ca1564f480b696e12f0e809dacc60ff97`	payload	2026-08-25	95%
md5_hash	`98597ac6d3479702b9efab392159bc48`	payload	2026-08-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - AsyncRAT
let malicious_hashes = dynamic(["66a1dfb08cb48494a16f60ecc6a827acb02388ddd364baafad3cc9774fcaae2d", "eddfa48ca1564f480b696e12f0e809dacc60ff97", "98597ac6d3479702b9efab392159bc48"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: AsyncRAT IOCs detection rule in an enterprise environment:

Scenario: Endpoint Detection & Response (EDR) Agent Communication
- Context: Enterprise EDR agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) periodically download threat intelligence updates and configuration profiles from their cloud management consoles. These downloads often utilize the same network ports and destination IP ranges that AsyncRAT uses for its command-and-control (C2) channel.
- Filter/Exclusion: Create a whitelist rule excluding traffic originating from EDR agent processes (e.g., FalconSensor.exe, MsMpEng.exe) connecting to known vendor update servers. Additionally, exclude specific destination IP ranges belonging to the EDR provider’s cloud infrastructure.
Scenario: Scheduled Software Deployment via SCCM/Intune
- Context: System Center Configuration Manager (SCCM) or Microsoft Intune agents execute scheduled tasks during maintenance windows to deploy software patches and application updates. These agents often establish outbound connections to the deployment server or content library, which can mimic the AsyncRAT beaconing behavior if the deployment server shares a similar ASN or IP block with known AsyncRAT infrastructure.
- Filter/Exclusion: Exclude alerts generated by processes associated with deployment tools (e.g., ccmexec.exe, Microsoft.IntuneManagementService.exe) when they connect to internal distribution point IPs or specific Azure Content Delivery Network ranges used for patching.
Scenario: Legitimate Remote Administration via RDP/VNC
- Context: IT administrators frequently use remote management tools (such as TeamViewer, AnyDesk, or proprietary VNC clients) to troubleshoot workstations. These tools often utilize similar protocol signatures and port usage (e.g., HTTPS on 443 or custom