ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving AsyncRAT remote access trojan indicators to identify potential command-and-control communications or lateral movement within the network. Proactively hunting for these specific IOCs in Azure Sentinel is critical because AsyncRAT’s ability to execute arbitrary commands and exfiltrate data makes it a high-priority target for early detection before significant compromise occurs.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["148.163.71.140", "195.177.94.169"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["148.163.71.140", "195.177.94.169"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule, along with recommended filters and exclusions tailored for an enterprise environment:

• Scenario: Legitimate Remote Support Sessions via ConnectWise ScreenConnect (formerly GoToMeeting)

  • Context: The organization utilizes ConnectWise ScreenConnect for IT helpdesk remote support. When an agent initiates a session, the client application (ScreenConnect.exe) establishes multiple outbound connections to the vendor’s cloud infrastructure and downloads dynamic configuration scripts that match AsyncRAT network signatures (specifically C2 beacon patterns).
  • Filter/Exclusion: Create a filter to exclude traffic originating from the ScreenConnect process hash or specific service accounts (e.g., DOMAIN\HelpDeskAdmin) connecting to known vendor IP ranges (*.screenconnect.com). Additionally, exclude any detection where the user context is a member of the “Remote Support Agents” AD group.

• Scenario: Scheduled Software Deployment via SCCM/Intune

  • Context: During nightly maintenance windows, Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune pushes updates to endpoints. The deployment agent (ccmexec.exe or IntuneManagementExtension) downloads large payloads and establishes persistent connections that mimic the AsyncRAT file transfer protocol structure, triggering the “Hunt package” logic for IOCs related to data exfiltration.
  • Filter/Exclusion: Exclude detections occurring between 01:00 AM and 05:00 AM (local time) where the parent process is ccmexec.exe or IntuneManagementExtension. Furthermore, add a rule exclusion for file paths located within the standard deployment directories (C:\Windows\CCM\Logs or C:\Program Files\Microsoft Intune Management Extension).

• **Scenario: Internal DevOps