This hunt targets the presence of known AsyncRAT indicators of compromise, which are frequently used by threat actors to establish persistent remote access and execute malicious payloads. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints early, potentially before the adversary escalates privileges or exfiltrates sensitive data.
Malware Family: AsyncRAT Total IOCs: 19 IOC Types: ip:port, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | as.vbizd.sbs | botnet_cc | 2026-09-25 | 75% |
| domain | as.quats.sbs | botnet_cc | 2026-09-25 | 75% |
| domain | as.sxlid.sbs | botnet_cc | 2026-09-25 | 75% |
| domain | as.zends.sbs | botnet_cc | 2026-09-25 | 75% |
| domain | as.bulkz.sbs | botnet_cc | 2026-09-25 | 75% |
| domain | as.wordz.sbs | botnet_cc | 2026-09-25 | 75% |
| domain | as.viaqs.sbs | botnet_cc | 2026-09-25 | 75% |
| ip:port | 161[.]248[.]179[.]92:111 | botnet_cc | 2026-09-25 | 75% |
| ip:port | 145[.]63[.]135[.]23:8808 | botnet_cc | 2026-09-25 | 75% |
| ip:port | 109[.]238[.]86[.]106:7707 | botnet_cc | 2026-09-25 | 75% |
| ip:port | 109[.]238[.]86[.]106:8808 | botnet_cc | 2026-09-25 | 75% |
| ip:port | 107[.]173[.]59[.]118:8580 | botnet_cc | 2026-09-25 | 75% |
| ip:port | 104[.]243[.]248[.]63:3601 | botnet_cc | 2026-09-25 | 75% |
| ip:port | 102[.]220[.]163[.]36:7007 | botnet_cc | 2026-09-25 | 75% |
| ip:port | 23[.]132[.]164[.]72:8080 | botnet_cc | 2026-09-25 | 100% |
| domain | qaqfahai.com | botnet_cc | 2026-09-25 | 75% |
| ip:port | 103[.]48[.]84[.]225:443 | botnet_cc | 2026-09-25 | 100% |
| ip:port | 103[.]48[.]84[.]225:80 | botnet_cc | 2026-09-25 | 100% |
| ip:port | 103[.]48[.]84[.]225:3306 | botnet_cc | 2026-09-25 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["104.243.248.63", "23.132.164.72", "102.220.163.36", "103.48.84.225", "107.173.59.118", "161.248.179.92", "109.238.86.106", "145.63.135.23"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["104.243.248.63", "23.132.164.72", "102.220.163.36", "103.48.84.225", "107.173.59.118", "161.248.179.92", "109.238.86.106", "145.63.135.23"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - AsyncRAT
let malicious_domains = dynamic(["as.vbizd.sbs", "as.quats.sbs", "as.sxlid.sbs", "as.zends.sbs", "as.bulkz.sbs", "as.wordz.sbs", "as.viaqs.sbs", "qaqfahai.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Scenario: Automated Patch Management Agents
wuaclt.exe or wuaclt.exe with specific arguments to check for updates. If an IOC matches a common hash or filename associated with the update client or a temporary download location (e.g., %TEMP%\), it may trigger a false positive.wuaclt.exe or ccmexec.exe, or exclude file paths under C:\Windows\SoftwareDistribution\ and C:\Windows\CCM\.Scenario: Scheduled Backup Jobs
VeeamBackup.exe, AcronisService.exe, or any process running under the C:\Program Files\Veeam\ or C:\Program Files\Acronis\ directories. Also, exclude scheduled tasks named VeeamBackup or AcronisBackup.Scenario: Endpoint Detection and Response (EDR) Agents