ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt targets the presence of known AsyncRAT indicators of compromise, which are frequently used by adversaries to establish persistent remote access and execute malicious commands on compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected systems before the RAT can fully establish a foothold, exfiltrate sensitive data, or pivot to other assets within the Azure environment.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 11 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`96[.]9[.]226[.]22:8808`	botnet_cc	2026-09-10	75%
ip:port	`80[.]190[.]77[.]86:2002`	botnet_cc	2026-09-10	75%
ip:port	`62[.]171[.]148[.]175:7707`	botnet_cc	2026-09-10	75%
ip:port	`62[.]171[.]148[.]175:8808`	botnet_cc	2026-09-10	75%
ip:port	`194[.]26[.]192[.]153:7707`	botnet_cc	2026-09-10	75%
ip:port	`185[.]242[.]3[.]250:7707`	botnet_cc	2026-09-10	75%
ip:port	`172[.]86[.]74[.]104:7707`	botnet_cc	2026-09-10	75%
ip:port	`172[.]86[.]74[.]104:8808`	botnet_cc	2026-09-10	75%
ip:port	`138[.]16[.]178[.]77:7707`	botnet_cc	2026-09-10	75%
ip:port	`128[.]90[.]135[.]53:4444`	botnet_cc	2026-09-10	75%
ip:port	`103[.]108[.]66[.]160:7707`	botnet_cc	2026-09-10	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["138.16.178.77", "62.171.148.175", "194.26.192.153", "96.9.226.22", "128.90.135.53", "80.190.77.86", "172.86.74.104", "103.108.66.160", "185.242.3.250"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["138.16.178.77", "62.171.148.175", "194.26.192.153", "96.9.226.22", "128.90.135.53", "80.190.77.86", "172.86.74.104", "103.108.66.160", "185.242.3.250"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

Legacy .NET Application Deployment: Developers or DevOps engineers deploying custom internal applications built on the .NET Framework may use System.Threading.Timer or System.Timers.Timer classes for background task scheduling, which can match the Timer IOC.
- Filter/Exclusion: Exclude processes where the parent process is msbuild.exe, dotnet.exe, or vstest.console.exe, or where the image path resides in standard development directories like C:\Program Files\Microsoft Visual Studio\ or C:\src\.
Enterprise Backup and Archiving Tools: Third-party backup solutions (e.g., Veeam, Acronis, or Commvault) often use asynchronous I/O operations and may load specific DLLs or execute helper binaries that contain strings matching the async or rat IOCs during data deduplication or compression tasks.
- Filter/Exclusion: Exclude processes where the parent process is known backup agents (e.g., VeeamBackupSvc.exe, AcronisService.exe) or where the command line contains arguments like --dedupe, --compress, or --archive.
Java-based Middleware and Application Servers: Java applications (running on Tomcat, JBoss, or WebLogic) frequently use java.util.Timer or java.util.concurrent.ScheduledExecutorService for task scheduling. If the detection logic inspects memory strings or loaded libraries, the presence of Timer or Async in Java class names or stack traces can trigger false positives.
- Filter/Exclusion: Exclude processes where the executable is java.exe or jre64.exe, and the command line contains JVM flags like -jar, -cp, or -Djava.library.path, or where the image path includes jre or jdk.
**Network Monitoring and Packet