ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving AsyncRAT remote access trojan indicators that facilitate command-and-control communication and lateral movement within the network. A SOC team should proactively hunt for these IOCs in Azure Sentinel to identify early-stage infections before attackers establish persistent footholds or exfiltrate sensitive data.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 4 IOC Types: md5_hash, sha256_hash, sha1_hash, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["159.203.69.210"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["159.203.69.210"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - AsyncRAT
let malicious_hashes = dynamic(["2b45aeb88bf38dd8dfbb13390c5b0f5efd6a298a6f967ac773cf47b2489ee5ab", "3526ba1e856cf7c229ac3149ba05eeacf74fa7d6", "23ed3c85947705b76a5bc6dfaaff0b41"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

• Scenario 1: Automated Patch Management Deployments

  • Context: Enterprise patch management tools (e.g., Microsoft Endpoint Configuration Manager or Ivanti Neurons) frequently download and execute installer packages that match the AsyncRAT IOCs, particularly when distributing updates to remote desktop clients. The detection logic may flag the hash of a legitimate update payload as an AsyncRAT indicator.
  • Filter/Exclusion: Exclude processes originating from C:\Program Files\Microsoft Configuration Manager\ or C:\ProgramData\Ivanti\. Add a filter to ignore alerts where the parent process is ccmsetup.exe (SCCM) or agent.exe (Ivanti).

• Scenario 2: Scheduled Remote Support Sessions

  • Context: IT Helpdesk teams utilize remote support tools like AnyDesk, TeamViewer, or Splashtop for scheduled maintenance windows. These tools often communicate with external management servers using network signatures and file hashes that overlap with AsyncRAT’s command-and-control (C2) patterns, triggering false positives during off-hours.
  • Filter/Exclusion: Create an exclusion based on the user context; ignore alerts triggered by service accounts named SUPPORT-ADMIN or specific AD groups like IT-Helpdesk. Additionally, filter out network connections to known support vendor IP ranges (e.g., AnyDesk’s public IPs) during defined maintenance windows (02:00–04:00 UTC).

• Scenario 3: Third-Party Endpoint Detection & Response (EDR) Scans

  • Context: Internal EDR agents (such as CrowdStrike Falcon,