ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt targets known indicators of compromise associated with AsyncRAT, a remote access trojan frequently used by threat actors to establish persistent, stealthy control over compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected assets before the adversary can leverage the RAT for lateral movement, data exfiltration, or further payload delivery.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 6 IOC Types: sha1_hash, ip:port, md5_hash, sha256_hash

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["217.60.198.81", "80.190.77.86", "64.89.160.29"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["217.60.198.81", "80.190.77.86", "64.89.160.29"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - AsyncRAT
let malicious_hashes = dynamic(["457371960d83375e5c805ebc7b99932b", "2eea097e689004e05f44f04ff22909c96d43d04fa7e5936f3709cf0d3a36c041", "9bd21215d9551af44e0230d281efdd16218313fd"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

• Legitimate Remote Support Sessions: IT support teams or MSPs may use commercial remote access tools (e.g., TeamViewer, AnyDesk, or RustDesk) that share similar network beaconing intervals or port usage with AsyncRAT.
  • Filter/Exclusion: Exclude known remote support application executables (e.g., TeamViewer.exe, AnyDesk.exe) and their associated network connections from the IOC match, or whitelist specific user accounts tagged with the RemoteSupport security group.
• Developer Build and Test Environments: Developers running local instances of AsyncRAT for testing, reverse engineering, or integration with custom CI/CD pipelines may trigger network or process-based IOCs.
  • Filter/Exclusion: Exclude hosts within the Dev-Test subnet or those tagged with the Development machine group, and filter out processes spawned by IDEs (e.g., code.exe, idea64.exe) or build agents (e.g., vstsagent.exe).
• Scheduled Maintenance Scripts: Automated PowerShell or Bash scripts used for log rotation, backup verification, or health checks may execute commands or open network connections that match the specific IOCs (e.g., specific netstat patterns or registry keys).
  • Filter/Exclusion: Correlate alerts with scheduled task execution logs; exclude events where the parent process is TaskScheduler.exe or cron and the command line matches known maintenance script patterns (e.g., powershell.exe -ExecutionPolicy Bypass -File C:\Scripts\HealthCheck.ps1).
• Third-Party Monitoring Agents: APM (Application Performance Monitoring) agents like Dynatrace, New Relic, or AppDynamics may install lightweight collectors that beacon to internal servers using ports or protocols that overlap with AsyncRAT’s C2 channels.
  • Filter/Exclusion: Whit