ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving AsyncRAT remote access trojan indicators to identify potential command-and-control communications and lateral movement within the network. Proactively hunting for these specific IOCs in Azure Sentinel is critical because AsyncRAT’s advanced stealth capabilities often evade standard signature-based defenses, requiring manual correlation to prevent undetected persistence and data exfiltration.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 8 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["23.175.48.7", "178.16.52.136", "207.189.22.218", "155.94.150.221", "128.90.63.117", "104.243.248.63"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["23.175.48.7", "178.16.52.136", "207.189.22.218", "155.94.150.221", "128.90.63.117", "104.243.248.63"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - AsyncRAT
let malicious_domains = dynamic(["aappicha.ddns.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule, along with suggested filters or exclusions tailored for an enterprise environment:

• Scenario: Legitimate Remote Administration via TeamViewer or AnyDesk

  • Context: Enterprise helpdesk teams frequently use remote desktop tools like TeamViewer, AnyDesk, or Splashtop to troubleshoot user workstations. These tools often establish persistent background services and network connections that mimic the behavioral patterns (e.g., specific registry keys, service names, or outbound ports) of AsyncRAT.
  • Filter/Exclusion: Create an exclusion rule based on the ProcessName field for known remote administration binaries (e.g., TeamViewer.exe, AnyDesk.exe) and exclude alerts where the parent process is a trusted admin account (e.g., DOMAIN\Helpdesk_Admin).

• Scenario: Scheduled Software Deployment via SCCM or Intune

  • Context: IT operations regularly deploy software updates or configuration scripts using Microsoft Endpoint Configuration Manager (SCCM) or Intune. These deployment agents often execute background processes that install components, modify registry keys, and establish network sessions similar to the AsyncRAT IOCs.
  • Filter/Exclusion: Filter out alerts where the ParentProcessName is ccmexec.exe (SCCM) or Microsoft.IntuneManagementAgent.exe, specifically during defined maintenance windows (e.g., 02:00–04:00 local time).

• Scenario: Internal Development Build Pipelines

  • Context: In organizations with internal development teams, CI/CD pipelines using tools like Jenkins, GitLab Runner, or Azure DevOps Agents frequently compile code and deploy artifacts. These agents often utilize similar communication protocols and file system interactions that match