This hunt detects adversary activity involving AsyncRAT remote access trojan indicators, which are known to facilitate command-and-control communications and lateral movement within compromised networks. The SOC team should proactively search for these IOCs in Azure Sentinel to identify early-stage infections before the malware establishes persistence or exfiltrates sensitive data.
Malware Family: AsyncRAT Total IOCs: 12 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 23[.]94[.]197[.]120:7707 | botnet_cc | 2026-07-22 | 75% |
| ip:port | 203[.]99[.]149[.]78:6606 | botnet_cc | 2026-07-22 | 75% |
| ip:port | 192[.]227[.]219[.]71:3341 | botnet_cc | 2026-07-22 | 75% |
| ip:port | 157[.]20[.]182[.]21:1338 | botnet_cc | 2026-07-22 | 75% |
| ip:port | 157[.]20[.]182[.]21:1337 | botnet_cc | 2026-07-22 | 75% |
| ip:port | 147[.]50[.]253[.]241:4415 | botnet_cc | 2026-07-22 | 75% |
| ip:port | 217[.]60[.]241[.]34:7707 | botnet_cc | 2026-07-22 | 75% |
| ip:port | 217[.]60[.]241[.]34:8808 | botnet_cc | 2026-07-22 | 75% |
| ip:port | 217[.]60[.]241[.]34:6606 | botnet_cc | 2026-07-22 | 100% |
| ip:port | 104[.]168[.]134[.]25:8808 | botnet_cc | 2026-07-22 | 100% |
| ip:port | 193[.]161[.]193[.]99:7474 | botnet_cc | 2026-07-21 | 75% |
| ip:port | 193[.]161[.]193[.]99:49916 | botnet_cc | 2026-07-21 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["147.50.253.241", "203.99.149.78", "157.20.182.21", "23.94.197.120", "193.161.193.99", "217.60.241.34", "104.168.134.25", "192.227.219.71"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["147.50.253.241", "203.99.149.78", "157.20.182.21", "23.94.197.120", "193.161.193.99", "217.60.241.34", "104.168.134.25", "192.227.219.71"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding filters for the ThreatFox: AsyncRAT IOCs detection rule in an enterprise environment:
Scenario: Legitimate Remote Administration via PowerShell
PowerShell.exe to query remote systems or deploy configurations. If a specific AsyncRAT IOC (e.g., a known hash of a utility script) matches the signature of a custom internal automation module, it triggers an alert when an admin runs a scheduled PowerShell job that imports this module.powershell.exe running under a domain admin account (e.g., DOMAIN\AD-Admins) and the command line contains specific internal script paths (e.g., C:\Scripts\Internal\Deploy.ps1).Scenario: Endpoint Protection Scanning of Quarantine Archives
SYSTEM or MDE-Service) where the file path is located within the vendor’s quarantine directory (e.g., C:\ProgramData\Microsoft\Windows Defender\Quarantine\).Scenario: Scheduled Backup Jobs Accessing Shared Resources