ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt detects adversary behavior consistent with the AsyncRAT remote access trojan by identifying specific indicators of compromise across network and endpoint telemetry within Azure Sentinel. Proactively hunting for these signatures is critical to rapidly identify early-stage lateral movement or command-and-control communications before they escalate into full-scale data exfiltration incidents.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 3 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`192[.]162[.]199[.]149:6606`	botnet_cc	2026-06-30	75%
ip:port	`130[.]12[.]182[.]95:8808`	botnet_cc	2026-06-30	100%
ip:port	`128[.]90[.]141[.]238:4444`	botnet_cc	2026-06-29	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["128.90.141.238", "130.12.182.95", "192.162.199.149"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["128.90.141.238", "130.12.182.95", "192.162.199.149"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Endpoint Protection Scanning of Quarantined Archives
- Scenario: The organization’s EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a deep scan of a quarantined archive file containing historical malware samples. During this process, the scanner extracts and analyzes known AsyncRAT IOCs (such as specific SHA-256 hashes or registry keys) that are present within the sample database but not actively executing on the host.
- Filter/Exclusion: Exclude alerts where the Process Name is the EDR sensor service (e.g., C:\Program Files\CrowdStrike\fs.exe or MsMpEng.exe) and the File Path indicates a quarantine or sample repository directory rather than an active user application folder.
IT Admin Deployment of Remote Management Tools
- Scenario: An IT administrator uses a remote deployment tool (e.g., SCCM, Ansible, or PDQ Deploy) to push a configuration update that includes the installation of a third-party remote support agent (like TeamViewer or AnyDesk). The installer script temporarily writes AsyncRAT-associated registry keys or network connections to verify compatibility before finalizing the install.
- Filter/Exclusion: Create an exclusion for processes initiated by known deployment service accounts (e.g., DOMAIN\svc-deploy or LocalSystem) where the parent process is a recognized configuration management tool, specifically during standard maintenance windows (e.g., 02:00–06:00 local time).
Scheduled Vulnerability Assessment Scans
- Scenario: A scheduled vulnerability scanner (such as Tenable Nessus or Qualys) runs