ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving AsyncRAT remote access trojan indicators to identify potential command-and-control communications and lateral movement within the network. Proactively hunting for these specific IOCs in Azure Sentinel is critical because AsyncRAT’s advanced evasion capabilities allow it to persist undetected, enabling attackers to exfiltrate sensitive data before traditional alerts trigger.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["186.169.88.130", "198.23.185.98", "104.243.248.63"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["186.169.88.130", "198.23.185.98", "104.243.248.63"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule, along with suggested filters or exclusions tailored for an enterprise environment:

• Scenario: Legitimate RMM Agent Communication

  • Context: Enterprise Remote Monitoring and Management (RMM) tools like Datto RMM, NinjaOne, or ManageEngine Desktop Central often utilize similar communication patterns, registry keys, or file hashes to the AsyncRAT IOCs. These agents frequently push updates or collect telemetry data that matches the rule’s signature.
  • Filter/Exclusion: Create an exclusion based on the specific process name and parent process of the RMM agent (e.g., Datto.Agent.exe running under System or a dedicated service account). Alternatively, whitelist the specific file hash of the RMM agent’s updater component if it matches one of the 3 IOCs.

• Scenario: Scheduled Software Deployment via SCCM/Intune

  • Context: During scheduled maintenance windows, Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune deploys software packages that may include components with file paths or registry keys identical to AsyncRAT indicators. This often occurs when deploying third-party utilities that share a common installer framework.
  • Filter/Exclusion: Filter alerts where the Parent_Process_Name is ccmsetup.exe, msiexec.exe, or IntuneManagementExtension.exe. Additionally, exclude events occurring within specific time windows (e.g., 02:00–04:00 UTC) if deployments are known to run during these hours.

• Scenario: Internal DevOps Build Artifacts

  • Context: Internal CI/CD pipelines using tools like Jenkins, GitLab Runner, or Azure DevOps Agents often generate build artifacts