This hunt targets the presence of known AsyncRAT indicators of compromise, which are frequently used by adversaries to establish persistent remote access and execute malicious commands on compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected assets before the threat actor can leverage the RAT for lateral movement or data exfiltration.
Malware Family: AsyncRAT Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 93[.]233[.]109[.]96:51125 | botnet_cc | 2026-09-04 | 75% |
| ip:port | 190[.]102[.]41[.]198:7707 | botnet_cc | 2026-09-04 | 75% |
| ip:port | 158[.]94[.]209[.]209:7707 | botnet_cc | 2026-09-04 | 75% |
| ip:port | 102[.]220[.]160[.]198:2600 | botnet_cc | 2026-09-04 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["158.94.209.209", "93.233.109.96", "190.102.41.198", "102.220.160.198"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["158.94.209.209", "93.233.109.96", "190.102.41.198", "102.220.160.198"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
rundll32.exe or msiexec.exe to execute background update scripts or register DLLs, which can match AsyncRAT’s known execution patterns.
sapgui.exe, portalclient.exe) and the command line contains standard update keywords like /i, /uninstall, or update.cmd.exe or powershell.exe to run maintenance tasks, potentially triggering IOCs related to script execution or network connections to internal management servers.
10.10.0.0/24) and the process name is powershell.exe or cmd.exe with a parent process identified as an automation agent (e.g., ccmexec.exe, ansible-service-runner).127.0.0.1, ::1, or within the developer lab VLAN (e.g., 192.168.100.0/24) and the process is associated with development tools (e.g., `node