ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the AsyncRAT remote access trojan by identifying specific indicators of compromise across network and endpoint telemetry within Azure Sentinel. Proactively hunting for these signatures is critical because AsyncRAT enables persistent command-and-control communications that can evade standard signature-based defenses, allowing attackers to exfiltrate sensitive data before detection occurs.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 5 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["157.20.182.17", "186.169.89.64", "130.12.182.95"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["157.20.182.17", "186.169.89.64", "130.12.182.95"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - AsyncRAT
let malicious_domains = dynamic(["botstart7.skillface.xyz"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Protection Scanning of Quarantined Archives

  • Scenario: The organization’s Endpoint Detection and Response (EDR) solution, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs a scheduled deep scan of the “Quarantine” folder. This folder often contains previously flagged but benign legacy software installers (e.g., old Java updates or internal deployment packages) that share hash values with known AsyncRAT IOCs. The EDR agent generates network traffic to the cloud management server while processing these files, triggering the hunt package.
  • Filter/Exclusion: Exclude network connections originating from the specific service accounts running the EDR agents (e.g., svc-crowdstrike or LocalSystem) when accessing internal quarantine storage paths (e.g., C:\ProgramData\Microsoft\Windows Defender\Quarantine). Additionally, filter out traffic where the destination IP belongs to the internal SIEM/EDR management cluster.

• Software Deployment via Configuration Management Tools

  • Scenario: During a monthly patch cycle, Ansible or SCCM (System Center Configuration Manager) deploys a new version of an internal HR application. The deployment package includes a third-party runtime library that matches one of the AsyncRAT IOCs (specifically a known DLL hash). As the job executes across 50+ workstations, the configuration management agent initiates outbound connections to download dependencies and report status, mimicking the command-and-control behavior of AsyncRAT.
  • Filter/Exclusion: Create an exclusion for traffic generated by well-known deployment service accounts (e.g., DOMAIN\SCCM-Deploy-Svc) during defined maintenance windows (e.g., Sundays