ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving AsyncRAT remote access trojan activity by monitoring for specific indicators of compromise such as suspicious process execution and network connections to known malicious infrastructure. Proactively hunting these IOCs in Azure Sentinel is critical because AsyncRAT’s ability to evade traditional signature-based detection requires continuous, proactive validation to identify early-stage lateral movement and data exfiltration attempts before they escalate into full-scale breaches.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 6 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`216[.]250[.]254[.]245:6606`	botnet_cc	2026-07-15	75%
ip:port	`213[.]152[.]186[.]188:18856`	botnet_cc	2026-07-15	75%
ip:port	`216[.]250[.]250[.]247:8808`	botnet_cc	2026-07-15	75%
ip:port	`216[.]250[.]250[.]247:6606`	botnet_cc	2026-07-15	75%
ip:port	`216[.]250[.]250[.]247:7707`	botnet_cc	2026-07-15	75%
ip:port	`217[.]217[.]97[.]75:8787`	botnet_cc	2026-07-15	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["213.152.186.188", "216.250.254.245", "217.217.97.75", "216.250.250.247"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["213.152.186.188", "216.250.254.245", "217.217.97.75", "216.250.250.247"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Endpoint Detection and Response (EDR) Scanner Updates
- Scenario: The organization’s EDR agent (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) performs a scheduled definition update. During this process, the scanner downloads a large payload containing known benign hashes that overlap with AsyncRAT’s generic C2 beacon signatures or DLL injection patterns used by legitimate security tools.
- Filter/Exclusion: Create an exclusion rule to ignore alerts originating from specific EDR service accounts (e.g., NT SERVICE\CrowdStrikeService, LocalSystem running C:\Program Files\CrowdStrike\csagent.exe) or exclude network traffic destined for the vendor’s update servers (e.g., *.crowdstrike.com, update.microsoft.com).
IT Asset Management and Patch Deployment
- Scenario: The IT Operations team utilizes a centralized patch management tool like Microsoft SCCM (Configuration Manager) or Ivanti Endpoint Manager. When deploying a critical security update, the agent executes a script that establishes an outbound HTTPS connection to a distribution point. This traffic pattern mimics the AsyncRAT “Heartbeat” IOC due to similar TLS handshake intervals and User-Agent strings used by enterprise management agents.
- Filter/Exclusion: Exclude network flows where the source process is ccmexec.exe (SCCM) or ivagent.exe (Ivanti) connecting to internal IP ranges designated for Software Distribution Points (e.g., 10.20.30.0/24).
Scheduled Remote Administration Tasks
- Scenario: A scheduled PowerShell job runs nightly under the context of a Domain