ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving AsyncRAT remote access trojan indicators by monitoring for specific file hashes and network connections associated with its known infrastructure. Proactively hunting for these IOCs in Azure Sentinel is critical to identify early-stage compromises that leverage AsyncRAT’s advanced command-and-control capabilities, enabling rapid containment before lateral movement occurs.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 7 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`46[.]151[.]182[.]76:6606`	botnet_cc	2026-07-28	75%
ip:port	`217[.]165[.]57[.]247:8808`	botnet_cc	2026-07-28	75%
ip:port	`207[.]246[.]75[.]30:8808`	botnet_cc	2026-07-28	75%
ip:port	`178[.]16[.]53[.]68:3009`	botnet_cc	2026-07-28	75%
ip:port	`130[.]12[.]182[.]249:6606`	botnet_cc	2026-07-28	75%
ip:port	`54[.]167[.]234[.]100:8000`	botnet_cc	2026-07-28	100%
ip:port	`160[.]30[.]20[.]216:8443`	botnet_cc	2026-07-28	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["54.167.234.100", "46.151.182.76", "207.246.75.30", "160.30.20.216", "130.12.182.249", "178.16.53.68", "217.165.57.247"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["54.167.234.100", "46.151.182.76", "207.246.75.30", "160.30.20.216", "130.12.182.249", "178.16.53.68", "217.165.57.247"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Legitimate Remote Administration via PowerShell
- Context: Enterprise administrators frequently use PowerShell.exe to query remote systems or deploy configurations. If the AsyncRAT IOCs include specific file hashes or network connections (e.g., connecting to a known internal IP on port 443) that match the tool’s signature, legitimate admin scripts may trigger alerts when executing commands like Get-Service or Invoke-Command.
- Filter/Exclusion: Exclude processes where the parent process is powershell.exe and the command line contains specific administrative keywords (e.g., -Command, -File) originating from the domain controller subnet. Additionally, whitelist known internal IP addresses used by the IT Operations team in the network detection logic.
Scenario: Scheduled Backup Jobs Utilizing Encryption
- Context: Automated backup solutions like Veeam Backup & Replication or Commvault often establish encrypted connections to central repositories. If AsyncRAT IOCs include specific TLS fingerprints or file paths (e.g., C:\Program Files\AsyncRAT\...), these backup agents might generate traffic patterns that mimic the malware’s communication behavior, especially during nightly maintenance windows.
- Filter/Exclusion: Create a time-based exclusion for alerts occurring between 01:00 and 05:00 UTC on days where scheduled jobs are active. Furthermore, exclude process paths matching C:\Program Files\Veeam\ or C:\Program Files\Commvault\ from the file hash detection logic.
Scenario: Software Deployment via SCCM/Intune
- Context: During mass software deployments using **Microsoft Endpoint