ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This detection rule identifies indicators of compromise linked to the AsyncRAT remote access trojan, which adversaries deploy to establish persistent command and control channels on compromised endpoints. Proactively hunting for these specific IOCs within Azure Sentinel is critical because AsyncRAT’s ability to execute arbitrary commands and exfiltrate data makes early identification essential for preventing lateral movement and sensitive information leakage.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 6 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`185[.]34[.]147[.]35:443`	botnet_cc	2026-08-19	100%
ip:port	`185[.]34[.]147[.]33:443`	botnet_cc	2026-08-19	100%
ip:port	`159[.]203[.]69[.]210:12262`	botnet_cc	2026-08-19	75%
ip:port	`185[.]235[.]137[.]195:6606`	botnet_cc	2026-08-19	75%
ip:port	`41[.]100[.]227[.]210:3030`	botnet_cc	2026-08-19	75%
ip:port	`121[.]200[.]216[.]84:443`	botnet_cc	2026-08-19	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["159.203.69.210", "121.200.216.84", "41.100.227.210", "185.34.147.33", "185.34.147.35", "185.235.137.195"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["159.203.69.210", "121.200.216.84", "41.100.227.210", "185.34.147.33", "185.34.147.35", "185.235.137.195"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

Legitimate Endpoint Management Agent Updates
- Scenario: The primary EDR or management agent (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon, or Ivanti Neurons) initiates a background update process that matches the AsyncRAT network beaconing pattern. Specifically, the agent’s communication with its cloud backend mimics the specific User-Agent strings and destination ports defined in the AsyncRAT IOC list.
- Filter/Exclusion: Create an exclusion rule based on the Process Name (e.g., MsMpEng.exe, FalconSensorService.exe) and Parent Process (svchost.exe or services.exe). Additionally, exclude traffic originating from known internal management subnets (e.g., 10.50.x.x/24).
Scheduled Software Deployment via Configuration Management Tools
- Scenario: A scheduled deployment job using tools like Microsoft SCCM, Jamf Pro, or Ansible Tower pushes a software patch to endpoints. The deployment client establishes persistent connections and exchanges telemetry data that triggers the AsyncRAT file hash or network signature, particularly when deploying remote access utilities that share similar cryptographic signatures with AsyncRAT components.
- Filter/Exclusion: Implement a time-based exclusion for known maintenance windows (e.g., 02:00 - 06:00 UTC). Furthermore, filter out alerts where the Process Command Line contains specific deployment identifiers (e.g., --deployment-id or --task-sequence) associated with the Configuration Management tool.
Remote Support Sessions by IT Helpdesk
- Scenario: The IT Helpdesk