ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This detection rule identifies potential AsyncRAT malware activity by monitoring for three specific Indicators of Compromise (IOCs) known to be utilized by this remote access trojan. Proactive hunting is essential in Azure Sentinel because AsyncRAT’s ability to establish persistent command-and-control channels allows adversaries to exfiltrate sensitive data and maintain long-term stealth within the environment before traditional alerts trigger.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 3 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`80[.]190[.]77[.]86:2414`	botnet_cc	2026-08-30	75%
ip:port	`64[.]177[.]112[.]21:50`	botnet_cc	2026-08-30	75%
ip:port	`188[.]212[.]158[.]203:8808`	botnet_cc	2026-08-30	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["188.212.158.203", "64.177.112.21", "80.190.77.86"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["188.212.158.203", "64.177.112.21", "80.190.77.86"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule, along with targeted filtering strategies suitable for an enterprise environment:

Scenario: Legitimate Software Deployment via SCCM/Intune
- Context: Enterprise IT administrators frequently deploy remote management tools or productivity suites (e.g., Microsoft Teams updates, Zoom client patches) using System Center Configuration Manager (SCCM) or Microsoft Intune. These deployment agents often execute background processes that match AsyncRAT’s known IOCs (specific file hashes or command-line arguments used for telemetry).
- Filter/Exclusion: Create a rule exclusion based on the Process Name and User Context. Exclude alerts where the parent process is ccmexec.exe (SCCM) or IntuneManagementExtension.exe, and the running user account belongs to the Enterprise-Admins security group.
Scenario: Scheduled Backup Jobs Utilizing Similar Hash Signatures
- Context: Automated backup solutions like Veeam Agent for Microsoft Windows or Acronis Cyber Protect often run scheduled tasks that generate temporary files with hashes overlapping AsyncRAT’s IOCs during the indexing phase. These jobs typically run under a dedicated service account (e.g., DOMAIN\BackupSvc) rather than an interactive user session.
- Filter/Exclusion: Implement a logic filter to suppress alerts where the Process Command Line contains specific backup keywords (e.g., --backup-mode, --indexing) and the Logon Type is “Service” or “Batch”. Additionally, whitelist the specific file paths located in the vendor’s installation directory (e.g., C:\Program Files\Veeam\Agent\).
Scenario: Endpoint Detection & Response (EDR) Self-Scanning
- Context: The organization’s primary EDR solution