ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving AsyncRAT remote access trojan indicators by matching network and host telemetry against a curated set of seven specific threat intelligence signatures. Proactive hunting for these IOCs within Azure Sentinel is critical to identify early-stage lateral movement and command-and-control communications that may evade standard signature-based detections, thereby reducing the dwell time of this sophisticated RAT.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 7 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`23[.]95[.]103[.]215:7707`	botnet_cc	2026-08-12	75%
ip:port	`23[.]95[.]103[.]215:8808`	botnet_cc	2026-08-12	75%
ip:port	`158[.]94[.]208[.]101:963`	botnet_cc	2026-08-12	75%
ip:port	`158[.]94[.]208[.]101:7707`	botnet_cc	2026-08-12	75%
ip:port	`158[.]94[.]208[.]101:777`	botnet_cc	2026-08-12	75%
ip:port	`104[.]243[.]248[.]63:410`	botnet_cc	2026-08-12	75%
ip:port	`213[.]152[.]161[.]91:8707`	botnet_cc	2026-08-12	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["158.94.208.101", "23.95.103.215", "213.152.161.91", "104.243.248.63"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["158.94.208.101", "23.95.103.215", "213.152.161.91", "104.243.248.63"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

Scenario: Legitimate Remote Administration via RMM Tools
- Context: Enterprise Remote Monitoring and Management (RMM) tools like ManageEngine Desktop Central, SolarWinds N-central, or TeamViewer often utilize similar communication patterns, ports, and binary execution behaviors as AsyncRAT. When these agents perform scheduled health checks or remote control sessions, they may trigger the IOCs related to network connections or process creation.
- Filter/Exclusion: Create an exclusion rule that suppresses alerts where the parent process is a known RMM agent (e.g., DesktopCentralAgent.exe, n-central-agent.exe) and the destination IP belongs to the organization’s internal management subnet or verified cloud provider ranges.
Scenario: Scheduled Backup Jobs Executing via PowerShell
- Context: Automated backup solutions such as Veeam, Rubrik, or custom scripts running via Task Scheduler often invoke powershell.exe or cmd.exe to initiate data transfers and verification reports. These jobs frequently generate network traffic and file system artifacts that mimic AsyncRAT’s command-and-control (C2) beaconing behavior, particularly if the backup destination is a cloud storage bucket.
- Filter/Exclusion: Exclude alerts where the process path matches known backup tool directories (e.g., C:\Program Files\Veeam\Backup and Replication...) and the execution time aligns with defined maintenance windows (e.g., 02:00–04:00 UTC). Additionally, filter out events where the command line contains specific keywords like “Veeam,” “Rubrik,” or “BackupJob.”
**Scenario: Software Deployment via Microsoft Endpoint