ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This detection rule identifies potential AsyncRAT remote access trojan activity by monitoring for four specific indicators of compromise within network and endpoint telemetry. Proactively hunting for these signals in Azure Sentinel is critical to rapidly detect early-stage lateral movement and command-and-control communications before adversaries establish persistent footholds or exfiltrate sensitive data.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`196[.]70[.]69[.]77:5000`	botnet_cc	2026-08-28	100%
ip:port	`80[.]190[.]77[.]86:20700`	botnet_cc	2026-08-28	75%
ip:port	`196[.]70[.]69[.]77:5001`	botnet_cc	2026-08-28	75%
ip:port	`157[.]20[.]182[.]21:1973`	botnet_cc	2026-08-28	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["80.190.77.86", "196.70.69.77", "157.20.182.21"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["80.190.77.86", "196.70.69.77", "157.20.182.21"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Legitimate Software Deployment via SCCM or Intune
- Context: Enterprise deployment tools like Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune often push updates or installers that contain the same hash signatures or network patterns associated with AsyncRAT. This is common when deploying internal line-of-business applications or patching legacy software that bundles similar runtime libraries.
- Suggested Filter/Exclusion: Exclude processes where the parent process is ccmsetup.exe (SCCM) or IntuneManagementExtension.exe. Additionally, filter out alerts originating from known deployment servers (e.g., DEPLOY-SRV-01) within the corporate IP range.
Scenario: Scheduled Maintenance Tasks for Remote Monitoring Tools
- Context: IT Operations teams frequently use remote monitoring agents (such as SolarWinds NPM, Datadog Agent, or PRTG) that run scheduled jobs to collect telemetry data. These agents may utilize network beacons or file artifacts that match the AsyncRAT IOCs, particularly during nightly maintenance windows between 02:00 and 04:00 UTC.
- Suggested Filter/Exclusion: Create a time-based exclusion for alerts occurring during defined maintenance windows (e.g., 02:00-04:00 daily). Alternatively, exclude specific service accounts used by monitoring tools, such as svc-monitoring-agent, and filter out processes with the executable path containing \Program Files\SolarWinds\.
Scenario: Development Environments Running CI/CD Pipelines
- Context: In R&D or DevOps environments, build agents (e.g., Jenkins,