This hunt targets the presence of known AsyncRAT indicators, which are frequently used by adversaries to establish persistent remote access and execute command-and-control operations within compromised environments. Proactively hunting for these IOCs in Azure Sentinel is critical because AsyncRAT is a high-severity threat often leveraged in targeted intrusions, allowing the SOC to identify and contain stealthy RAT deployments before they escalate to lateral movement or data exfiltration.
Malware Family: AsyncRAT Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 91[.]92[.]241[.]149:7707 | botnet_cc | 2026-09-19 | 75% |
| ip:port | 91[.]92[.]241[.]149:9090 | botnet_cc | 2026-09-19 | 75% |
| ip:port | 188[.]137[.]227[.]133:8808 | botnet_cc | 2026-09-19 | 75% |
| ip:port | 102[.]220[.]160[.]198:7707 | botnet_cc | 2026-09-19 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["102.220.160.198", "188.137.227.133", "91.92.241.149"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["102.220.160.198", "188.137.227.133", "91.92.241.149"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Legacy Java Application Deployment: AsyncRAT often uses Java-based payloads or interacts with JVM processes. In environments running legacy enterprise applications (e.g., WebLogic, Tomcat, or custom Java microservices), the deployment of new JAR files or the execution of java processes by service accounts during CI/CD pipelines or manual updates may match the process or file hash IOCs.
mvn, gradle, ant) or where the executable path resides in standard application directories (e.g., C:\Program Files\Java\, C:\app\logs\) and the user context is a dedicated service account (e.g., APP_SERVICE_ACCT).Scheduled Backup or Maintenance Scripts: Many IOCs for AsyncRAT involve specific file names, registry keys, or scheduled tasks used for persistence. If an enterprise uses generic names for maintenance scripts (e.g., update.bat, sync.ps1, or backup_task) that are scheduled via Task Scheduler or cron jobs, these legitimate administrative tasks can trigger the detection if they match the specific IOC strings or paths.
vssadmin, wbadmin, rsync, robocopy) or where the task owner is a known admin group (e.g., DOMAIN\Admins, LOCAL\Backup_Ops) and the execution time aligns with the standard maintenance window.Development and QA Environments: Developers and QA engineers frequently test Remote Access Trojans (RATs) or use lightweight remote desktop tools that mimic RAT behavior (e.g., using nc (netcat), socat, or custom Python/Go scripts for port forwarding).