ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of AsyncRAT remote access trojans by monitoring for specific indicators of compromise such as malicious network connections and file artifacts. Proactively hunting for these IOCs in Azure Sentinel is critical because early detection of this high-severity threat enables rapid containment before attackers can establish persistent command-and-control channels or exfiltrate sensitive data.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 7 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["13.53.169.83", "130.49.214.23", "198.135.49.85"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["13.53.169.83", "130.49.214.23", "198.135.49.85"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - AsyncRAT
let malicious_domains = dynamic(["ratsales.duckdns.org", "robin43hf.duckdns.org", "ferjksax.duckdns.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule in an enterprise environment, along with recommended filters or exclusions:

• Endpoint Protection Agent Updates and Scans

  • Scenario: Enterprise Endpoint Detection and Response (EDR) agents (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) frequently download signature updates or perform heuristic scans that generate network connections to known security vendor IP ranges. If the AsyncRAT IOC list includes generic IP blocks or common ports used by these vendors, legitimate update traffic may trigger an alert.
  • Filter/Exclusion: Create a whitelist rule excluding traffic originating from specific EDR service accounts (e.g., NT AUTHORITY\SYSTEM, CrowdStrike Falcon Service) and destination IPs belonging to the organization’s primary security vendor update servers.

• Scheduled Software Deployment via SCCM or Intune

  • Scenario: System Center Configuration Manager (SCCM) or Microsoft Intune often pushes software updates, patches, or new application installations during maintenance windows. These deployment agents may establish connections to distribution points or cloud endpoints that match the AsyncRAT IOCs (particularly if the IOCs include common web server IPs or specific file hashes used by content delivery networks).
  • Filter/Exclusion: Exclude alerts where the process name matches known deployment tools (e.g., ccmexec.exe, Microsoft.Ingestion.Service, IntuneManagementExtension) and restrict the detection to non-maintenance windows (e.g., exclude 02:00–06:00 UTC) or specific distribution point IP ranges.

• IT Administration Remote Management Sessions

  • Scenario: IT administrators frequently use remote management tools like Microsoft System Center Operations Manager (SCOM), Ivanti, or custom PowerShell scripts to query asset inventory or manage configurations across the fleet. These