ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving AsyncRAT remote access tools by identifying matches against seven specific indicators of compromise known to facilitate command and control operations. Proactively hunting for these signals in Azure Sentinel is critical because early detection of AsyncRAT deployments allows the SOC team to disrupt potential lateral movement and data exfiltration before adversaries establish persistent footholds within the network.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 7 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`91[.]242[.]163[.]227:5174`	botnet_cc	2026-08-13	75%
ip:port	`217[.]60[.]241[.]247:7722`	botnet_cc	2026-08-13	75%
ip:port	`185[.]34[.]147[.]34:8080`	botnet_cc	2026-08-13	75%
ip:port	`185[.]34[.]147[.]35:8080`	botnet_cc	2026-08-13	75%
ip:port	`185[.]34[.]147[.]31:8080`	botnet_cc	2026-08-13	75%
ip:port	`185[.]34[.]147[.]32:8080`	botnet_cc	2026-08-13	75%
ip:port	`130[.]12[.]182[.]39:2500`	botnet_cc	2026-08-13	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["185.34.147.35", "130.12.182.39", "217.60.241.247", "185.34.147.31", "185.34.147.32", "185.34.147.34", "91.242.163.227"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["185.34.147.35", "130.12.182.39", "217.60.241.247", "185.34.147.31", "185.34.147.32", "185.34.147.34", "91.242.163.227"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Automated Patching Deployment via SCCM/Intune
- Scenario: The Enterprise Configuration Management tool (e.g., Microsoft Endpoint Configuration Manager or Intune) pushes a scheduled update to the AsyncRAT client software itself, triggering network connections and file modifications that match the AsyncRAT IOCs.
- Filter/Exclusion: Exclude traffic originating from the specific IP ranges of the SCCM Distribution Points or Intune Management Servers. Additionally, filter out processes where the parent executable is ccmsetup.exe (SCCM) or Microsoft.IntuneManagementService.exe.
Third-Party Remote Support Sessions
- Scenario: IT Helpdesk agents utilize a remote support tool (e.g., TeamViewer, AnyDesk, or Splashtop) to connect to user endpoints. These tools often establish similar C2-like communication patterns and file artifacts that overlap with AsyncRAT signatures during active sessions.
- Filter/Exclusion: Create an exclusion for the specific process names of known remote support tools (e.g., TeamViewer.exe, AnyDeskService.exe) when they are running under a domain admin account context. Exclude alerts where the user context is part of the “IT_Support” AD group.
Scheduled Antivirus Engine Updates
- Scenario: The enterprise endpoint protection suite (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) performs its daily definition update cycle. The update mechanism downloads signatures and modifies local database files in a manner that mimics the AsyncRAT IOCs regarding file hashes and network destinations.
- Filter/Exclusion: Exclude events occurring during the defined maintenance window (e.g., 0