ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the four specific indicators of compromise (IOCs) linked to the AsyncRAT remote access tool, which is frequently used by threat actors for command and control operations. A SOC team should proactively search for these IOCs in Azure Sentinel because early identification of AsyncRAT presence allows for rapid containment before adversaries establish persistent footholds or exfiltrate sensitive data.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`63[.]141[.]237[.]101:7707`	botnet_cc	2026-08-14	75%
ip:port	`217[.]60[.]241[.]247:7707`	botnet_cc	2026-08-14	75%
ip:port	`198[.]23[.]185[.]238:30305`	botnet_cc	2026-08-14	75%
ip:port	`43[.]226[.]47[.]184:8848`	botnet_cc	2026-08-14	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["217.60.241.247", "43.226.47.184", "63.141.237.101", "198.23.185.238"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["217.60.241.247", "43.226.47.184", "63.141.237.101", "198.23.185.238"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: AsyncRAT IOCs detection rule in an enterprise environment:

Scenario: Legitimate Remote Administration via RMM Tools
- Context: Enterprise Remote Monitoring and Management (RMM) solutions like ManageEngine Desktop Central, Lansweeper, or PDQ Deploy often utilize similar communication patterns to AsyncRAT for agent polling, software deployment, and remote session management. These tools may trigger the rule when agents initiate outbound connections to their cloud management consoles using ports or certificate hashes that overlap with known AsyncRAT IOCs.
- Suggested Filter/Exclusion: Exclude traffic originating from specific RMM service accounts (e.g., DOMAIN\RMM-Service) and whitelist the destination IP ranges of the vendor’s cloud infrastructure (e.g., AWS/Azure regions used by ManageEngine or PDQ).
Scenario: Scheduled Backup and Data Synchronization Jobs
- Context: Automated backup solutions such as Veeam Backup & Replication, Rubrik, or Microsoft Azure Backup Agent frequently establish persistent connections to storage repositories. During scheduled job windows (e.g., nightly at 02:00), these agents may generate network flows matching AsyncRAT IOCs, particularly if the backup software uses a similar C2 beaconing mechanism or specific User-Agent strings that mimic the threat signature.
- Suggested Filter/Exclusion: Create an exclusion for processes running under the Veeam or AzureBackup service names during defined maintenance windows (e.g., 01:00–05:00 local time), filtering by process path (e.g., C:\Program Files\Veeam\...).
Scenario: Internal Development and CI/CD Pipeline Artifacts
- Context: In development environments