ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior where malicious actors deploy AsyncRAT remote access trojans to establish persistent footholds and exfiltrate sensitive data via specific network indicators. Proactively hunting for these seven IOCs in Azure Sentinel is critical to rapidly identify early-stage infections before the malware can execute its full command-and-control capabilities across the enterprise environment.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 7 IOC Types: ip:port, domain, sha256_hash, md5_hash, sha1_hash

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["43.225.157.146", "45.32.90.122", "217.60.241.10"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["43.225.157.146", "45.32.90.122", "217.60.241.10"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - AsyncRAT
let malicious_domains = dynamic(["orthodontie-ge.ch"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - AsyncRAT
let malicious_hashes = dynamic(["9b225681a471b474fde2cca61ff61498a7c7f9e8", "2b46ed6e01f2baae933707d06704d14c", "e6d51d45edea7591b826b2d703c20a426fffa27a022c0156916ae9c35245bd07"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule, tailored for an enterprise environment:

• Endpoint Security Agent Updates and Scans

  • Scenario: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled definition update or deep scan. During this process, the agent extracts temporary installation files or sandbox analysis artifacts that match the SHA256 hashes of AsyncRAT IOCs found in public threat intelligence feeds, triggering alerts on high-volume workstations.
  • Filter/Exclusion: Create an exclusion rule to suppress alerts for processes originating from known security vendor directories (e.g., C:\Program Files\CrowdStrike\* or C:\Windows\System32\Microsoft Defender Antivirus\*) and specifically exclude file paths containing “Temp” or “Sandbox” folders during the defined maintenance window.

• Software Deployment via SCCM/Intune

  • Scenario: The IT Operations team deploys a critical application patch using Microsoft Endpoint Configuration Manager (SCCM) or Intune. The deployment package includes a third-party installer component that utilizes a shared library or script (e.g., a specific InstallShield wrapper or a generic NSIS installer) which shares a digital signature or file hash with the AsyncRAT IOCs, causing triggers across the entire domain during the rollout window.
  • Filter/Exclusion: Exclude alerts where the parent process is identified as ccmexec.exe (SCCM), IntuneManagementExtension.exe, or msiexec.exe, and limit the detection scope to exclude events occurring between 02:00 and 04:00 UTC, which aligns with standard change management deployment windows.

• Legacy Development Build Pipelines

  • Scenario: A