ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt targets the presence of AsyncRAT, a remote access trojan that enables adversaries to establish persistent, stealthy control over compromised endpoints for data exfiltration and lateral movement. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected assets before the attacker can leverage the RAT to execute further malicious actions or escalate privileges within the environment.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["153.75.251.188", "176.149.202.136"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["153.75.251.188", "176.149.202.136"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

• Legitimate Remote Support Tools (e.g., TeamViewer, AnyDesk, VNC):

  • Scenario: Enterprise IT support teams use remote access software that may share memory patterns, process names, or network endpoints with AsyncRAT IOCs, especially if the tool is installed in non-standard directories or runs under a service account.
  • Filter/Exclusion: Exclude processes where the parent process is a known remote support executable (e.g., TeamViewer.exe, AnyDesk.exe, vncserver.exe) or exclude connections to known internal IP ranges associated with the IT support jump host.

• Development and Testing Environments:

  • Scenario: Developers or QA engineers run AsyncRAT binaries or similar RATs in isolated lab environments, Docker containers, or VMs for security testing, malware analysis, or software development, triggering IOC matches on file hashes or memory strings.
  • Filter/Exclusion: Exclude hosts tagged with environment=dev, environment=qa, or role=lab in CMDB/Asset Inventory. Additionally, exclude processes running within containerized workloads (e.g., Docker, Kubernetes pods) unless explicitly flagged for production monitoring.

• Scheduled Backup or Cleanup Jobs:

  • Scenario: Scheduled tasks or services (e.g., Veeam, Acronis, custom PowerShell cleanup scripts) may temporarily load or reference files matching AsyncRAT IOCs during backup snapshots, deduplication, or temporary file handling, especially if the backup agent uses shared libraries or temp files with similar naming conventions.
  • Filter/Exclusion: Exclude events where the process name matches known backup agents (e.g., VeeamBackupSvc.exe, AcronisService.exe) or where the file path contains /temp/, /tmp/, or /backup/ directories.

• **Third