ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hypothesis targets the presence of known AsyncRAT indicators of compromise, which are frequently used by threat actors to establish persistent remote access and execute malicious commands within the environment. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised assets early, potentially before the attacker leverages the RAT for lateral movement or data exfiltration.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`84[.]247[.]187[.]47:4546`	botnet_cc	2026-09-13	75%
ip:port	`160[.]191[.]88[.]70:443`	botnet_cc	2026-09-13	75%
ip:port	`160[.]191[.]88[.]70:80`	botnet_cc	2026-09-13	75%
ip:port	`102[.]220[.]160[.]198:1505`	botnet_cc	2026-09-13	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["102.220.160.198", "84.247.187.47", "160.191.88.70"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["102.220.160.198", "84.247.187.47", "160.191.88.70"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

Scenario: A DevOps engineer uses a custom PowerShell script or a tool like Sysinternals to perform memory forensics or process analysis on a build server, where the script loads a shared library or DLL that matches one of the AsyncRAT hash IOCs (e.g., a generic kernel32.dll wrapper or a specific loader module used in the test environment).
- Filter/Exclusion: Exclude alerts where the parent process is a known development tool (e.g., pwsh.exe, python.exe, node.exe) and the file path resides in standard development directories (e.g., C:\dev\, C:\tools\, C:\Users\<user>\.vscode\).
Scenario: An IT administrator deploys a new version of a third-party remote management agent (e.g., LogMeIn, TeamViewer, or a custom RMM agent) that includes a helper DLL or executable with a hash matching an AsyncRAT IOC due to similar code signing or build artifacts.
- Filter/Exclusion: Exclude alerts if the file is signed by a trusted vendor certificate (e.g., LogMeIn, Inc., TeamViewer GmbH) and the file path is located in standard installation directories (e.g., C:\Program Files (x86)\, C:\Program Files\).
Scenario: A security team runs a YARA rule scan or a memory dump analysis tool (e.g., Volatility, Rekall) across the fleet, which temporarily loads or maps AsyncRAT-related modules into memory for testing purposes, triggering hash-based IOCs.
- Filter/Exclusion: Exclude alerts if the parent process is a known security tool (e.g., volatility3.exe, yara.exe, recon.exe) or if the alert occurs during a scheduled