ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This detection rule identifies active AsyncRAT remote access trojan infections by monitoring for specific indicators of compromise such as unique file hashes and network connections. Proactively hunting for these signals in Azure Sentinel is critical to rapidly detect stealthy lateral movement and data exfiltration attempts before adversaries establish persistent command-and-control channels.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`195[.]177[.]94[.]101:443`	botnet_cc	2026-08-31	100%
ip:port	`217[.]217[.]97[.]164:6606`	botnet_cc	2026-08-31	75%
ip:port	`195[.]177[.]94[.]101:80`	botnet_cc	2026-08-31	75%
ip:port	`102[.]220[.]160[.]198:7001`	botnet_cc	2026-08-31	75%
ip:port	`109[.]122[.]18[.]182:50062`	botnet_cc	2026-08-31	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["195.177.94.101", "217.217.97.164", "109.122.18.182", "102.220.160.198"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["195.177.94.101", "217.217.97.164", "109.122.18.182", "102.220.160.198"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Endpoint Security Agent Communication
- Scenario: The primary Endpoint Detection and Response (EDR) agent (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) initiates outbound HTTPS connections to its cloud management console. If the AsyncRAT IOCs include specific TLS SNI domains or IP ranges that overlap with the EDR vendor’s update servers, legitimate telemetry uploads may trigger an alert.
- Filter/Exclusion: Create a rule exclusion based on the Process Name of the EDR agent (e.g., MsMpEng.exe or FalconService) and restrict the match to specific Destination IP ranges known to belong to the security vendor, excluding any traffic from these processes regardless of the IOCs.
Software Deployment via Configuration Management Tools
- Scenario: Automated deployment tools like Microsoft SCCM (Configuration Manager) or Ansible Tower push new applications or patches to workstations. These tools often utilize specific executable wrappers or service accounts that download artifacts from internal repositories. If an AsyncRAT IOC matches a hash of a legitimate installer package or a shared repository URL used by the deployment tool, it will generate false positives during maintenance windows.
- Filter/Exclusion: Implement a time-based exclusion for alerts generated between 02:00 and 06:00 on weekdays (typical maintenance window) where the Source User is a known service account (e.g., DOMAIN\SCCM-Deploy-SVC) and the Parent Process is the deployment engine (e.g., ccmsetup.exe).
Third-Party Remote Support Tools
- Scenario: IT Helpdesk teams utilize