This hunt detects adversary activity involving AsyncRAT remote access trojan indicators to identify potential command-and-control communications and lateral movement within the network. The SOC team should proactively search for these specific IOCs in Azure Sentinel to rapidly isolate compromised endpoints before attackers can establish persistent footholds or exfiltrate sensitive data.
Malware Family: AsyncRAT Total IOCs: 6 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 80[.]190[.]77[.]86:7007 | botnet_cc | 2026-08-21 | 75% |
| ip:port | 198[.]23[.]185[.]98:6666 | botnet_cc | 2026-08-21 | 75% |
| ip:port | 198[.]23[.]185[.]98:7777 | botnet_cc | 2026-08-21 | 75% |
| ip:port | 185[.]34[.]147[.]35:7707 | botnet_cc | 2026-08-21 | 75% |
| ip:port | 185[.]34[.]147[.]34:7707 | botnet_cc | 2026-08-21 | 75% |
| ip:port | 185[.]34[.]147[.]33:7707 | botnet_cc | 2026-08-21 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["185.34.147.33", "185.34.147.35", "185.34.147.34", "198.23.185.98", "80.190.77.86"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["185.34.147.33", "185.34.147.35", "185.34.147.34", "198.23.185.98", "80.190.77.86"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:
Scenario: Scheduled Endpoint Protection Updates via Microsoft Defender
UpdateScan) that runs daily at 02:00 AM. This process often connects to the same update servers or downloads specific telemetry files that match the AsyncRAT network IOCs, triggering alerts due to identical hash values in shared certificate chains or update manifests.MpCmdRun.exe or MsMpEng.exe) and the Parent Process ID. If the parent process is identified as Task Scheduler (running under the SYSTEM account) during the maintenance window, suppress the alert.Scenario: Legitimate Remote Administration via TeamViewer or AnyDesk
TeamViewer.exe to known cloud endpoints that share IP ranges or TLS fingerprints with the ThreatFox AsyncRAT indicators.C:\Program Files\TeamViewer\TeamViewer.exe) and User Context. Exclude alerts where the running user is part of the IT-Support or Helpdesk Active Directory groups, as these accounts are authorized to run remote management tools.**Scenario: Automated Software Deployment via SCCM/Int