ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt hypothesis targets AsyncRAT activity by identifying remote command execution and data exfiltration patterns associated with known IOCs delivered through phishing vectors or exploit kits. Proactively hunting for these indicators in Azure Sentinel is critical to detect early-stage compromises that could lead to persistent unauthorized access and sensitive data theft before the adversary establishes a foothold.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`107[.]173[.]47[.]158:7707`	botnet_cc	2026-08-26	75%
ip:port	`104[.]243[.]248[.]63:400`	botnet_cc	2026-08-26	75%
ip:port	`101[.]99[.]92[.]134:4788`	botnet_cc	2026-08-26	75%
ip:port	`52[.]29[.]243[.]233:9000`	botnet_cc	2026-08-26	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["107.173.47.158", "52.29.243.233", "101.99.92.134", "104.243.248.63"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["107.173.47.158", "52.29.243.233", "101.99.92.134", "104.243.248.63"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

False Positive Scenarios for “ThreatFox: AsyncRAT IOCs” Detection Rule

Scenario 1: Legitimate Remote Support Sessions via TeamViewer/AnyDesk
- Context: Enterprise helpdesk teams frequently use remote desktop tools like TeamViewer, AnyDesk, or Splashtop to troubleshoot user issues. These tools often initiate outbound connections on ports (e.g., 5938, 4000) that overlap with AsyncRAT’s communication patterns, triggering alerts when connecting to known support gateways.
- Filter/Exclusion: Create an exclusion rule for the specific executable hashes and process names of approved remote tools (e.g., TeamViewer.exe, AnyDesk.exe) originating from the “IT Support” Active Directory group or specific IP ranges within the corporate DMZ.
Scenario 2: Scheduled Backup Jobs Utilizing Cloud Storage APIs
- Context: Automated backup solutions such as Veeam, Rubrik, or Azure Backup Agent run scheduled jobs that upload data to cloud endpoints. These agents often use HTTP/HTTPS traffic patterns and specific IP ranges for data transfer that mimic the “stealing data” behavior of AsyncRAT, particularly when connecting to public cloud storage buckets.
- Filter/Exclusion: Exclude alerts where the source process is identified as a known backup agent (e.g., Veeam.Backup.Service.exe) and the destination IP belongs to verified cloud provider ranges (e.g., Microsoft Azure US East regions or AWS S3 endpoints) during defined maintenance windows.
Scenario 3: Phishing Simulation Campaigns with Malicious Attachment Emulation
- Context: Security teams regularly conduct internal phishing simulations using platforms like KnowBe4 or Proofpoint. These campaigns often deploy test emails containing benign attachments (PDFs,