detects AsyncRAT

Hunt Hypothesis

This detection rule identifies the presence of AsyncRAT, a remote access trojan known for establishing persistent command-and-control channels to exfiltrate sensitive data from endpoints. Proactively hunting for this behavior in Azure Sentinel is critical because early identification allows the SOC team to isolate compromised assets before the adversary escalates privileges or expands lateral movement across the network.

YARA Rule

rule win_asyncrat_j1 {

    meta:
        author      = "Johannes Bader @viql"
        date        = "2020-04-26"
        description = "detects AsyncRAT"
        references  = "https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp"
        tlp         = "white"

    strings:
        $str_anti_1 = "VIRTUAL" wide
        $str_anti_2 = "vmware" wide
        $str_anti_3 = "VirtualBox" wide
        $str_anti_4 = "SbieDll.dll" wide

        $str_miner_1 = "--donate-level=" wide

        $str_b_rev_run    = "\\nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\erawtfoS" wide
        $str_b_msg_pack_1 = "(ext8,ext16,ex32) type $c7,$c8,$c9" wide
        $str_b_msg_pack_2 = "(never used) type $c1" wide
        $str_b_schtask_1  = "/create /f /sc ONLOGON /RL HIGHEST /tn \"'" wide
        $str_b_schtask_2  = "\"' /tr \"'" wide

        $str_config_1 = "Antivirus" wide
        $str_config_2 = "Pastebin" wide
        $str_config_3 = "HWID" wide
        $str_config_4 = "Installed" wide
        $str_config_5 = "Pong" wide
        $str_config_6 = "Performance" wide

    condition:
        all of ($str_anti_*)  and 
        4 of ($str_config_*) and ( 
            all of ($str_miner_*) or 
            3 of ($str_b_*)
        )
        
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 16 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the AsyncRAT detection rule in an enterprise environment, including suggested filters or exclusions:

• Scenario: Legitimate Remote Desktop Administration via Microsoft Endpoint Manager

  • Context: System administrators frequently use Microsoft Intune (Endpoint Manager) to push remote configuration tasks or troubleshoot devices. The AsyncRAT logic often flags the specific process behavior of IntuneManagementExtension.exe or the associated service when it establishes outbound connections to management gateways, mimicking the C2 (Command and Control) traffic patterns of AsyncRAT.
  • Suggested Filter: Exclude network traffic where the source process is IntuneManagementExtension.exe (or DeviceManagementService.exe) AND the destination IP belongs to the Microsoft Azure/Office 365 IP range, specifically filtering out ports associated with Intune MDM communication (e.g., TCP 443).

• Scenario: Scheduled Software Updates via SCCM or WSUS

  • Context: In environments using Microsoft System Center Configuration Manager (SCCM) or WSUS, the ccmexec.exe service runs scheduled jobs to download and install patches. During these windows, the process creates temporary network sessions and executes scripts that can trigger the AsyncRAT heuristic for “unusual process spawning” or “persistent background communication,” which are core indicators of the RAT’s installation phase.
  • Suggested Filter: Create an exclusion rule for ccmexec.exe processes running during defined maintenance windows (e.g., 02:00–04:00 UTC) that connect to known internal WSUS servers or Microsoft Update content delivery networks, excluding alerts where the parent process is TaskScheduler with a job name containing “SoftwareUpdate” or “PatchDeployment”.

• **Scenario: Enterprise Backup Operations using Veeam or Commvault