This hunt targets the presence of AsyncRAT indicators of compromise, a remote access trojan frequently used by threat actors to establish persistent control and execute arbitrary commands on compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify stealthy infections that may have bypassed initial perimeter defenses, enabling rapid containment before the adversary leverages the RAT for lateral movement or data exfiltration.
Malware Family: AsyncRAT Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 45[.]154[.]98[.]38:2004 | botnet_cc | 2026-09-03 | 75% |
| ip:port | 216[.]250[.]249[.]97:22207 | botnet_cc | 2026-09-03 | 75% |
| ip:port | 216[.]250[.]249[.]97:22206 | botnet_cc | 2026-09-03 | 75% |
| ip:port | 128[.]90[.]169[.]101:7777 | botnet_cc | 2026-09-03 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["216.250.249.97", "128.90.169.101", "45.154.98.38"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["216.250.249.97", "128.90.169.101", "45.154.98.38"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses Ansible or Terraform to deploy a new microservice, where the deployment script includes a curl or wget command to fetch a configuration file or binary from a staging server that happens to share an IP address or domain with a known AsyncRAT C2 node.
ansible-playbook.exe, terraform.exe, or python.exe (if running deployment scripts) and the destination port is 443 or 80, provided the connection originates from a dedicated CI/CD runner subnet or service account.Scenario: An IT administrator performs a manual patching task using WSUS (Windows Server Update Services) or SCCM (System Center Configuration Manager), where a specific update package or driver download is hosted on an internal mirror server that has a public IP listed in the ThreatFox IOC set due to a recent reassignment or shared hosting environment.
10.20.0.0/24 or specific public mirror IPs) when the source process is wuauclt.exe, ccmexec.exe, or svchost.exe (associated with Windows Update service), and the connection occurs during the defined maintenance window.Scenario: A security team conducts a penetration test or red team exercise using a tool like Cobalt Strike or Metasploit to simulate an AsyncRAT infection for validation purposes, intentionally using one of the known IOCs to verify detection coverage.
RedTeam or PenTest in AD, or where the source process is