This hunt targets the presence of known AsyncRAT indicators of compromise, which are frequently leveraged by threat actors to establish persistent remote access and execute post-compromise actions within the environment. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify and isolate compromised assets before the remote access tool can be used for lateral movement or data exfiltration.
Malware Family: AsyncRAT Total IOCs: 5 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 194[.]26[.]192[.]153:2001 | botnet_cc | 2026-09-17 | 75% |
| ip:port | 147[.]124[.]202[.]216:7707 | botnet_cc | 2026-09-17 | 75% |
| ip:port | 147[.]124[.]202[.]216:8808 | botnet_cc | 2026-09-17 | 75% |
| ip:port | 104[.]243[.]248[.]63:407 | botnet_cc | 2026-09-17 | 75% |
| ip:port | 102[.]220[.]163[.]36:2504 | botnet_cc | 2026-09-17 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["104.243.248.63", "194.26.192.153", "147.124.202.216", "102.220.163.36"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["104.243.248.63", "194.26.192.153", "147.124.202.216", "102.220.163.36"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A security operations team deploys a custom PowerShell script to scan for known AsyncRAT configuration files or registry keys during a routine vulnerability assessment or post-incident forensics. The script explicitly queries for the specific IOCs (e.g., specific mutex names or file paths) included in the hunt package, triggering the detection.
powershell.exe initiated by SecurityTool.exe or specific admin accounts) and the command line contains keywords like hunt, scan, or ioc-check. Alternatively, whitelist the specific user accounts or service accounts used for security tooling.Scenario: An IT administrator performs a manual cleanup of a previously infected workstation by deleting the AsyncRAT payload file (e.g., svchost.exe or a custom-named binary) from a network share or local disk. The file deletion event matches the IOC for the specific file hash or path.
explorer.exe, cmd.exe, powershell.exe) and the user belongs to the IT_Admins or Service_Accounts group. Ensure the exclusion is scoped to specific directories where cleanup artifacts are stored (e.g., C:\Temp\IncidentCleanup).Scenario: A development team uses a build automation tool (e.g., Jenkins, Azure DevOps) that compiles or tests a legacy application module known to contain a benign string or resource matching one of the AsyncRAT IOCs (e.g., a specific GUID or registry key used for feature toggling). The build agent writes this value to the registry or creates a temporary file.