ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving four specific indicators of compromise linked to the AsyncRAT remote access tool, which is frequently used by threat actors to establish persistent command and control channels within compromised networks. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify early-stage AsyncRAT deployments before they can be leveraged for lateral movement or data exfiltration, thereby reducing dwell time and mitigating potential impact from this high-severity threat.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 4 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["159.203.69.210", "34.11.43.142"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["159.203.69.210", "34.11.43.142"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - AsyncRAT
let malicious_domains = dynamic(["ronaldbeck.duckdns.org", "beckronald.duckdns.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Legitimate Remote Management Tool Usage

  • Context: Enterprise IT administrators frequently use remote management tools like TeamViewer, AnyDesk, or Microsoft Endpoint Configuration Manager (MECM) to manage workstations. These tools often utilize similar network ports and executable behaviors that overlap with AsyncRAT’s IOCs, particularly regarding outbound connections to known cloud infrastructure or specific registry modifications for persistence.
  • Suggested Filter/Exclusion: Create a whitelist exclusion for the process paths of these specific management agents (e.g., C:\Program Files\TeamViewer\TeamViewer.exe or C:\Windows\System32\sccm\client\ccmexec.exe) when they initiate network connections to trusted IP ranges defined in the enterprise’s firewall allow-list.

• Scenario: Scheduled Backup and Sync Operations

  • Context: Automated backup solutions such as Veeam Agent, Acronis Cyber Protect, or OneDrive for Business often run scheduled jobs during off-hours. These agents may create specific registry keys, modify file permissions, or establish persistent background services that mimic the persistence mechanisms and IOCs flagged by the AsyncRAT hunt package.
  • Suggested Filter/Exclusion: Implement a time-based exclusion window (e.g., 02:00 – 06:00 local time) for backup-related processes, or filter out alerts where the parent process is identified as a known backup service (e.g., vssvc.exe, OneDrive.exe) and the activity matches standard backup signatures.

• Scenario: DevOps CI/CD Pipeline Execution

  • Context: In development environments, build servers like **Jenkins