This hunt targets known indicators of compromise for AsyncRAT, a remote access trojan frequently used by threat actors to establish persistent control and exfiltrate data from compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected assets before the adversary can leverage the RAT for lateral movement or further payload delivery.
Malware Family: AsyncRAT Total IOCs: 8 IOC Types: md5_hash, sha256_hash, sha1_hash, ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 84[.]247[.]187[.]47:7707 | botnet_cc | 2026-09-11 | 75% |
| ip:port | 69[.]10[.]49[.]136:7777 | botnet_cc | 2026-09-11 | 75% |
| sha1_hash | adf038a93db8e4257045c826597a787260c653d8 | payload | 2026-09-11 | 95% |
| md5_hash | 4afdf3296a9a3b2c96faffadab698fb7 | payload | 2026-09-11 | 95% |
| sha256_hash | 728834dcff6bd34de67b0b15547352c53785d515eb5d46c5c448cb8284d2c20a | payload | 2026-09-11 | 95% |
| sha256_hash | 8a148ed494d7e89568338a44439a4b94426c427030281ecbe9d6a42803c22c41 | payload | 2026-09-11 | 95% |
| sha1_hash | 7361c266de18e4e6e5c7e4eb726bae9611deeee4 | payload | 2026-09-11 | 95% |
| md5_hash | 1c87823e24223ab11407693f57dda4de | payload | 2026-09-11 | 95% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["69.10.49.136", "84.247.187.47"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["69.10.49.136", "84.247.187.47"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - AsyncRAT
let malicious_hashes = dynamic(["adf038a93db8e4257045c826597a787260c653d8", "4afdf3296a9a3b2c96faffadab698fb7", "728834dcff6bd34de67b0b15547352c53785d515eb5d46c5c448cb8284d2c20a", "8a148ed494d7e89568338a44439a4b94426c427030281ecbe9d6a42803c22c41", "7361c266de18e4e6e5c7e4eb726bae9611deeee4", "1c87823e24223ab11407693f57dda4de"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceFileEvents | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
curl or wget to download a specific version of a third-party library or tool (e.g., libasyncio or a custom build of asyncio for Python projects) from a public GitHub repository or internal artifact registry, where the filename or URL path contains the string “async” or matches a known AsyncRAT hash due to a shared dependency.
10.20.0.0/24) AND the user agent or process name is curl, wget, or python executing a script in the C:\Projects\ or /home/dev/ directories.System.Net.Http.HttpClient in .NET) and logs the operation with a tag or filename like AsyncUpdateJob.exe or async_patch.ps1, which matches the IOC pattern for AsyncRAT’s common naming conventions.
powershell.exe or pwsh.exe AND the command line contains ScheduledTask or TaskScheduler AND the working directory is under C:\ProgramData\CorporateTools\ or C:\Scripts\.AsyncRAT_Test.bin or using a test harness that mimics AsyncRAT’s behavior (e.g., creating a mutex named AsyncRAT_Mutex) to verify detection coverage, triggering the rule during a controlled test window.