ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior characterized by network connections to known AsyncRAT infrastructure, indicating potential remote access trojan deployment within the environment. Proactively hunting these specific indicators in Azure Sentinel is critical because early detection of this high-severity threat prevents lateral movement and data exfiltration before the malware fully establishes its command-and-control channels.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 6 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["86.48.16.94", "34.106.101.107", "147.50.253.241", "193.161.193.99"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["86.48.16.94", "34.106.101.107", "147.50.253.241", "193.161.193.99"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - AsyncRAT
let malicious_domains = dynamic(["contabili.balanteo.shop"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Security Agent Updates and Scans

  • Scenario: The organization’s primary Endpoint Detection and Response (EDR) solution, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs scheduled definition updates or deep scans. These agents often download large payload files containing known AsyncRAT signatures from the vendor’s repository to update their local threat intelligence database, triggering a file hash match on the detection rule.
  • Suggested Filter: Exclude network traffic and file creation events originating from the specific service accounts used by the EDR agent (e.g., svc_crowdstrike, LocalSystem running MsMpEng.exe) or whitelist the specific SHA-256 hashes of the vendor’s update packages.

• IT Asset Management and Software Deployment

  • Scenario: The IT operations team utilizes Microsoft SCCM (Configuration Manager) or Ivanti Endpoint Manager to deploy a new version of an enterprise communication tool (e.g., Zoom Enterprise or Microsoft Teams) which includes the AsyncRAT framework as a telemetry component. During the deployment window, the installer creates temporary files and registry keys that match the AsyncRAT IOCs across thousands of workstations simultaneously.
  • Suggested Filter: Create an exclusion for processes spawned by known deployment orchestrators (e.g., ccmexec.exe, IvantiAgent.exe) and filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) on the specific asset group receiving the update.

• Scheduled Backup and Data Archiving Jobs

  • Scenario: A legacy scheduled job running via Windows Task Scheduler utilizes a third