ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving AsyncRAT remote access trojan indicators to identify potential command-and-control communications or lateral movement within the network. Proactively hunting for these specific IOCs in Azure Sentinel is critical because AsyncRAT’s stealthy nature allows attackers to maintain persistent access and exfiltrate sensitive data before traditional alerts trigger.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["5.21.239.104", "103.237.92.116"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["5.21.239.104", "103.237.92.116"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: AsyncRAT IOCs detection rule in an enterprise environment:

• Scenario: Scheduled Endpoint Protection Scans

  • Context: Enterprise anti-virus solutions (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) often perform scheduled hash verification or signature updates that match the specific file hashes or network patterns defined in the AsyncRAT IOCs. This is particularly common during off-hours maintenance windows where the EDR agent communicates with update servers using similar protocols.
  • Filter/Exclusion: Create a rule exclusion based on the Process Name of the known EDR agents (e.g., C:\Program Files\CrowdStrike\fsqa.exe or MsMpEng.exe) and restrict the alert to trigger only when these processes are running under non-administrator user contexts, as EDA scans typically run with SYSTEM privileges.

• Scenario: Software Deployment via Configuration Management

  • Context: Automated deployment tools like Microsoft SCCM (Configuration Manager) or Ansible Tower frequently push application updates or scripts to endpoints. If the deployed software package contains binaries that share cryptographic hashes or network signatures with AsyncRAT IOCs, the detection logic will flag these legitimate installation events as potential threats.
  • Filter/Exclusion: Implement an exclusion based on the Parent Process. Filter out alerts where the parent process is ccmsetup.exe (SCCM) or ansible-playbook, ensuring that only files spawned directly by user interaction or unknown services trigger the rule, while excluding those initiated by known deployment orchestrators.

• Scenario: Internal DevOps Build and Release Pipelines

  • Context: In environments with internal CI/CD pipelines (e.g., Jenkins, GitLab Runners), build agents often compile code or execute