ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt detects adversary behavior indicative of AsyncRAT remote access trojans by identifying specific indicators of compromise such as malicious process execution and network connections to known command-and-control infrastructure. Proactively hunting for these IOCs in Azure Sentinel is critical because AsyncRAT’s ability to establish persistent, stealthy sessions allows attackers to exfiltrate sensitive data before traditional signature-based alerts trigger.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["136.111.38.101", "188.209.158.161"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["136.111.38.101", "188.209.158.161"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: AsyncRAT IOCs rule in an enterprise environment, along with suggested filters and exclusions:

• Endpoint Protection Scanning of Quarantine Archives

  • Scenario: Enterprise Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon or Microsoft Defender for Endpoint periodically scan the “Quarantine” or “Threat History” folders. These archives often contain historical samples of AsyncRAT malware used for training or previous incident analysis, triggering a match against the detection logic even though no active infection exists on the endpoint.
  • Suggested Filter: Exclude file paths containing known quarantine directories (e.g., C:\ProgramData\Microsoft\Windows Defender\Quarantine or \CrowdStrike\Falcon\Quarantine) and filter for processes with a “Scanner” or “Service” classification in the process tree.

• SIEM Content Updates via Scheduled Tasks

  • Scenario: Security Operations teams utilize scheduled jobs (e.g., Task Scheduler on Windows Server) to ingest new threat intelligence feeds from platforms like Tenable.io or Recorded Future. During these nightly ingestion windows, the system downloads and parses IOC files that include AsyncRAT signatures for correlation testing, generating events that mimic an active detection.
  • Suggested Filter: Create a time-based exclusion for events occurring during known maintenance windows (e.g., 02:00–04:00 UTC) originating from specific service accounts (e.g., svc-threat-intel or System) executing the ingestion script (e.g., python.exe running feed_parser.py).

• Red Team Exercise and Purple Teaming Simulations

  • Scenario: Internal Red Teams conduct periodic simulations using tools like Cobalt Strike or **Atomic Red Team