ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt targets the presence of known AsyncRAT indicators of compromise, which are frequently used by adversaries to establish persistent remote access and execute malicious payloads. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised endpoints before the RAT can fully establish command-and-control channels or escalate privileges.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`188[.]212[.]158[.]203:1145`	botnet_cc	2026-09-24	75%
ip:port	`185[.]112[.]59[.]102:7707`	botnet_cc	2026-09-24	75%
ip:port	`185[.]112[.]59[.]102:8808`	botnet_cc	2026-09-24	75%
ip:port	`104[.]243[.]248[.]63:3606`	botnet_cc	2026-09-24	75%
ip:port	`102[.]220[.]163[.]36:2505`	botnet_cc	2026-09-24	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["102.220.163.36", "104.243.248.63", "185.112.59.102", "188.212.158.203"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["102.220.163.36", "104.243.248.63", "185.112.59.102", "188.212.158.203"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

Legacy Java Application Deployment: An enterprise Java application (e.g., Spring Boot or Tomcat-based services) uses java.util.concurrent or similar libraries that may generate memory patterns or specific class names matching AsyncRAT’s known IOCs (such as AsyncRAT or specific hash values in memory dumps).
- Filter/Exclusion: Exclude processes where the parent process is java.exe or jre.exe, or filter out events where the image path contains \jre\ or \java\.
Development Environment Testing: Developers testing AsyncRAT payloads in isolated lab environments or using containerized CI/CD pipelines (e.g., Docker images containing test scripts) may execute the binary or load its libraries during unit tests or integration tests.
- Filter/Exclusion: Exclude events where the process path contains \dev\, \test\, or \ci\, or where the parent process is docker.exe, kubectl, or code.exe (VS Code).
Backup and Restore Operations: Backup software (e.g., Veeam, Commvault, or Windows Server Backup) may restore or scan files that include known AsyncRAT sample files used for testing or previously quarantined items, triggering file-based IOCs during the restore or verification phase.
- Filter/Exclusion: Exclude events where the parent process is a known backup agent (e.g., Veeam.exe, commvault.exe, wbadmin.exe) or where the file path contains \backup\ or \restore\.
Security Tooling and EDR Telemetry: Security tools like YARA scanners, memory dump analyzers (e.g., Volatility), or EDR agents may load AsyncRAT signatures or sample files into memory for scanning, potentially triggering memory-based IOCs.
- Filter/Exclusion: Exclude