ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific indicators of compromise linked to the AsyncRAT remote access trojan, which is frequently used by threat actors to establish persistent command and control channels within compromised networks. Proactively hunting for these IOCs in Azure Sentinel is critical because AsyncRAT’s ability to execute arbitrary commands and exfiltrate sensitive data makes early detection essential for preventing lateral movement and data breaches before the adversary achieves full operational capability.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["45.61.114.217", "185.157.46.242"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.61.114.217", "185.157.46.242"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

False Positive Scenarios for “ThreatFox: AsyncRAT IOCs”

• Scenario: Legitimate Remote Administration via TeamViewer or AnyDesk

  • Context: Enterprise IT support teams frequently use remote desktop tools like TeamViewer, AnyDesk, or Splashtop to manage endpoints. These tools often utilize similar network ports (e.g., TCP 5938, 443) and C2 patterns that overlap with AsyncRAT’s communication signatures, particularly when the tools are configured for persistent background operation.
  • Suggested Filter/Exclusion: Create a filter to exclude alerts where the source process is TeamViewer.exe, AnyDeskService.exe, or SplashtopAgent.exe running under the SYSTEM or specific service accounts (e.g., DOMAIN\IT-Support). Additionally, whitelist the known hash values of these legitimate remote tools in the SIEM.

• Scenario: Scheduled Backup Jobs Utilizing Cloud Storage APIs

  • Context: Automated backup solutions such as Veeam, Rubrik, or Acronis Cyber Protect often initiate scheduled jobs that establish persistent connections to cloud storage endpoints (e.g., AWS S3, Azure Blob). The network traffic patterns and specific IOCs associated with these backup agents can mimic the AsyncRAT beaconing behavior detected by the rule.
  • Suggested Filter/Exclusion: Implement an exclusion based on the Scheduled Task name or process path. For instance, exclude alerts where the parent process matches paths like C:\Program Files\Veeam\Backup and Replication\... or C:\Program Files\Acronis\Cyber Protect\.... Filter by time windows if these jobs run exclusively during off-hours (e.g., 02:00–05:00).

• **Scenario: