This hunt identifies network connections or host artifacts matching known indicators of compromise for AsyncRAT, a remote access trojan frequently used for initial access and persistent control. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect stealthy RAT deployments that may bypass traditional signature-based detections, enabling rapid containment before the adversary establishes a stable foothold in the environment.
Malware Family: AsyncRAT Total IOCs: 10 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 82[.]26[.]66[.]179:55555 | botnet_cc | 2026-09-14 | 75% |
| ip:port | 192[.]162[.]199[.]179:7707 | botnet_cc | 2026-09-14 | 75% |
| ip:port | 185[.]34[.]147[.]34:8443 | botnet_cc | 2026-09-14 | 75% |
| ip:port | 185[.]34[.]147[.]33:8443 | botnet_cc | 2026-09-14 | 75% |
| ip:port | 185[.]34[.]147[.]32:8443 | botnet_cc | 2026-09-14 | 75% |
| ip:port | 185[.]34[.]147[.]31:8443 | botnet_cc | 2026-09-14 | 75% |
| ip:port | 161[.]248[.]179[.]92:8080 | botnet_cc | 2026-09-14 | 75% |
| ip:port | 149[.]30[.]222[.]243:7707 | botnet_cc | 2026-09-14 | 75% |
| ip:port | 135[.]136[.]147[.]238:8808 | botnet_cc | 2026-09-14 | 75% |
| ip:port | 102[.]220[.]160[.]198:6666 | botnet_cc | 2026-09-14 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["161.248.179.92", "149.30.222.243", "185.34.147.33", "135.136.147.238", "102.220.160.198", "82.26.66.179", "192.162.199.179", "185.34.147.34", "185.34.147.31", "185.34.147.32"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["161.248.179.92", "149.30.222.243", "185.34.147.33", "135.136.147.238", "102.220.160.198", "82.26.66.179", "192.162.199.179", "185.34.147.34", "185.34.147.31", "185.34.147.32"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses curl or wget to download a specific version of a third-party library or build artifact from a public GitHub repository or internal artifact registry (e.g., https://github.com/asyncrat/... or a mirrored URL) that matches one of the IOCs (specifically URL or domain-based indicators).
curl, wget, or PowerShell (if the IOC is a URL) AND the source IP is within the internal RFC1918 range or a known CI/CD subnet. Additionally, whitelist specific domains if the IOC is a domain name (e.g., *.github.io or internal artifact servers).Scenario: A system administrator runs a scheduled PowerShell script to perform routine health checks or log rotation, which inadvertently accesses a URL or file path that matches a file hash or URL IOC (e.g., checking for the existence of a specific config file or downloading a small diagnostic tool).
powershell.exe or pwsh.exe AND the command line contains keywords like Test-Path, Get-ChildItem, or Invoke-WebRequest with a -UseBasicParsing flag, and the user account belongs to a service account or admin group (e.g., DOMAIN\svc_admin, DOMAIN\IT_Ops).Scenario: A security team or blue team member performs a manual hunt or validation test by intentionally accessing one of the AsyncRAT IOCs (e.g., pinging a domain or downloading a sample file) to verify detection coverage or update threat intelligence feeds.
sec_, blue_, hunt_, or validation_, or where