ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior where malicious actors deploy AsyncRAT remote access trojans to establish persistent command-and-control channels and exfiltrate sensitive data using specific known indicators of compromise. The SOC team should proactively search for these IOCs in Azure Sentinel to rapidly identify early-stage infections before the malware escalates to full network reconnaissance or lateral movement phases.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["198.23.185.221", "102.220.160.222"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["198.23.185.221", "102.220.160.222"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule in an enterprise environment, along with recommended filters or exclusions:

• Endpoint Protection Scanning of Quarantined Archives

  • Scenario: The organization’s EDR (e.g., CrowdStrike Falcon or Microsoft Defender) performs a scheduled deep scan of the network share \\FileServer\Quarantine. During this process, the scanner extracts and analyzes a known benign archive containing legacy AsyncRAT configuration files used for internal remote support. The extraction process triggers the IOCs associated with the AsyncRAT executable and its specific file hashes within the quarantine folder.
  • Filter/Exclusion: Exclude alerts where the parent process is the EDR scanner (e.g., C:\Program Files\CrowdStrike\csagent.exe or MsMpEng.exe) AND the file path contains keywords like \Quarantine\, \Staging\, or \ScanResults.

• IT Helpdesk Remote Support Sessions

  • Scenario: The IT Service Desk utilizes a legitimate remote management tool (e.g., ConnectWise Control, TeamViewer, or Splashtop) that internally leverages AsyncRAT components for agent communication. When an administrator initiates a “Remote Assist” session to troubleshoot a user’s workstation, the agent launches the AsyncRAT service and connects to the central management server, generating network traffic and file system events matching the threat IOCs.
  • Filter/Exclusion: Create an exclusion for network connections originating from the AsyncRAT process where the destination IP belongs to the internal IT Management subnet (e.g., 10.50.20.0/24) OR where the user context is a member of the IT-Admins or Helpdesk-Support security groups.

• **Autom