ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt identifies network connections to known AsyncRAT command-and-control infrastructure, indicating a potential remote access trojan deployment that enables persistent adversary control over compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect and isolate infected assets before the attacker can establish a foothold, execute further payloads, or exfiltrate sensitive data.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 8 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`217[.]60[.]76[.]250:7707`	botnet_cc	2026-09-16	75%
ip:port	`217[.]60[.]76[.]250:8808`	botnet_cc	2026-09-16	75%
ip:port	`172[.]94[.]18[.]103:74`	botnet_cc	2026-09-16	75%
ip:port	`172[.]86[.]112[.]104:8808`	botnet_cc	2026-09-16	75%
ip:port	`172[.]86[.]112[.]104:7707`	botnet_cc	2026-09-16	75%
ip:port	`121[.]200[.]216[.]74:443`	botnet_cc	2026-09-16	75%
ip:port	`102[.]220[.]163[.]36:7006`	botnet_cc	2026-09-16	75%
ip:port	`102[.]220[.]160[.]198:56003`	botnet_cc	2026-09-16	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["172.86.112.104", "102.220.160.198", "217.60.76.250", "172.94.18.103", "102.220.163.36", "121.200.216.74"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["172.86.112.104", "102.220.160.198", "217.60.76.250", "172.94.18.103", "102.220.163.36", "121.200.216.74"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

Scenario: A legacy Java-based application or internal tool uses the specific SHA256 hash of the AsyncRAT loader binary for integrity checking or digital signature verification during a scheduled update cycle.
- Filter/Exclusion: Exclude alerts where the source process is a known Java runtime (java.exe, jre.exe) or a specific internal application service account, and the file path resides within the application’s bin or lib directory.
Scenario: A system administrator manually downloads the AsyncRAT sample (or a similar RAT variant) to a jump host or analysis VM to perform static analysis or test detection rules in a non-production environment.
- Filter/Exclusion: Exclude hosts tagged with env:dev, env:test, or role:jump-host in your CMDB or asset inventory. Additionally, exclude processes running under user accounts with names like analyst, qa, or devops.
Scenario: A third-party backup or snapshot tool (e.g., Veeam, Commvault) creates a temporary copy of a file that matches the IOC hash in a staging directory (e.g., C:\Temp\BackupStaging) before compression and transfer.
- Filter/Exclusion: Exclude file paths containing Backup, Snapshot, Staging, or Temp directories associated with known backup service accounts. Verify the parent process is the backup agent executable (e.g., VeeamBackupSvc.exe).
Scenario: A security team deploys a canary token or honeypot file with the specific AsyncRAT IOC hash to a shared network drive to detect lateral movement or unauthorized access.
- Filter/Exclusion: Exclude alerts originating from shared network paths (e.g., \\fileserver\security\canaries\) or hosts explicitly tagged as `honeyp