ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This detection rule identifies indicators of compromise linked to the AsyncRAT remote access trojan, which adversaries deploy to establish persistent command-and-control channels and exfiltrate sensitive data from compromised endpoints. Proactively hunting for these specific IOCs within Azure Sentinel is critical because AsyncRAT’s ability to operate stealthily across diverse network environments allows attackers to maintain long-term access before triggering standard alerting mechanisms.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`80[.]190[.]77[.]86:10700`	botnet_cc	2026-08-29	75%
ip:port	`46[.]109[.]235[.]15:7707`	botnet_cc	2026-08-29	75%
ip:port	`169[.]58[.]180[.]142:30300`	botnet_cc	2026-08-29	75%
ip:port	`217[.]165[.]57[.]176:8808`	botnet_cc	2026-08-29	100%
ip:port	`196[.]70[.]69[.]77:5000`	botnet_cc	2026-08-28	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["169.58.180.142", "80.190.77.86", "196.70.69.77", "46.109.235.15", "217.165.57.176"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["169.58.180.142", "80.190.77.86", "196.70.69.77", "46.109.235.15", "217.165.57.176"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Legitimate Software Deployment via SCCM/Intune
- Context: Enterprise deployment tools like Microsoft Endpoint Configuration Manager (SCCM) or Intune often push updates or new applications that include the specific DLLs or executable hashes associated with AsyncRAT. During a scheduled maintenance window, these tools may install software containing AsyncRAT components, triggering the IOC match.
- Filter/Exclusion: Exclude processes where the parent process is ccmsetup.exe (SCCM) or Microsoft.IntuneManagementExtension.exe, and restrict the rule to trigger only outside of defined maintenance windows (e.g., 02:00–04:00 UTC).
Scenario: Scheduled Remote Support Sessions
- Context: The IT Helpdesk team utilizes a remote support tool (such as TeamViewer, AnyDesk, or a proprietary wrapper) that shares underlying libraries with AsyncRAT. When an analyst initiates a scheduled remote session to troubleshoot a workstation, the detection logic may flag the connection as a potential AsyncRAT infection due to matching network signatures or file hashes.
- Filter/Exclusion: Create an exclusion for specific user groups (e.g., IT-Support, Helpdesk) and filter out alerts where the source IP belongs to the internal Helpdesk VLAN range, provided the process name matches known support tools like TeamViewer_Service.exe or AnyDeskService.exe.
Scenario: Third-Party Backup Agent Execution
- Context: Enterprise backup solutions (e.g., Veeam, Commvault, or Acronis) often run scheduled jobs that utilize compression and encryption libraries identical to those flagged in the Async