ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving AsyncRAT remote access trojan indicators by monitoring for specific file hashes and network connections known to facilitate command-and-control communication and lateral movement. A SOC team should proactively hunt for these IOCs in Azure Sentinel because AsyncRAT is a prevalent threat capable of establishing persistent, stealthy footholds that often evade standard signature-based defenses until significant compromise occurs.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 7 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`46[.]151[.]182[.]16:2202`	botnet_cc	2026-07-30	75%
ip:port	`217[.]60[.]241[.]73:7011`	botnet_cc	2026-07-30	75%
ip:port	`147[.]78[.]243[.]192:443`	botnet_cc	2026-07-30	75%
ip:port	`164[.]152[.]167[.]222:443`	botnet_cc	2026-07-30	75%
ip:port	`167[.]253[.]157[.]140:443`	botnet_cc	2026-07-30	75%
ip:port	`155[.]138[.]203[.]207:8888`	botnet_cc	2026-07-30	100%
ip:port	`157[.]20[.]182[.]21:4443`	botnet_cc	2026-07-30	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["46.151.182.16", "217.60.241.73", "155.138.203.207", "147.78.243.192", "164.152.167.222", "157.20.182.21", "167.253.157.140"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["46.151.182.16", "217.60.241.73", "155.138.203.207", "147.78.243.192", "164.152.167.222", "157.20.182.21", "167.253.157.140"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: AsyncRAT IOCs detection rule in an enterprise environment:

Scenario: Automated Endpoint Protection Scans
- Context: Enterprise EDR agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently download definition updates or perform scheduled scans that match the specific file hashes or network signatures of AsyncRAT. This often occurs during off-hours maintenance windows where the agent connects to update servers using similar protocols.
- Filter/Exclusion: Exclude processes originating from known EDR service executables (e.g., C:\Program Files\CrowdStrike\fsqu.exe or C:\Windows\System32\mpcmdrun.exe) and restrict alerts to non-scheduled maintenance windows (e.g., 08:00–18:00 local time).
Scenario: IT Admin Remote Management Sessions
- Context: System administrators utilize remote management tools like Microsoft SCCM, Ivanti Neurons, or TeamViewer to deploy patches or troubleshoot workstations. These tools often establish outbound connections and execute scripts that mimic the process tree structure of AsyncRAT, particularly when interacting with the System account on remote hosts.
- Filter/Exclusion: Create a whitelist for processes running under the NT AUTHORITY\SYSTEM context initiated by known admin accounts (e.g., DOMAIN\AdminGroup) and exclude network traffic destined for internal management subnets (e.g., 10.x.x.x) rather than external public IPs.
Scenario: Scheduled Backup and Monitoring Agents
- Context: Third-party backup solutions (such as Veeam Agent or Acronis Cyber Protect) and monitoring agents (like Datadog or SolarWinds) often run scheduled jobs that generate