ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This detection rule identifies potential AsyncRAT malware activity by monitoring for five specific indicators of compromise that signify an adversary establishing a persistent remote access channel on compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel is critical to rapidly detect and contain this sophisticated RAT before it enables lateral movement, data exfiltration, or command-and-control communication within the enterprise network.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 5 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["91.92.242.32", "178.16.52.136", "104.243.248.63"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["91.92.242.32", "178.16.52.136", "104.243.248.63"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - AsyncRAT
let malicious_domains = dynamic(["updatewindows.gotdns.ch", "combustu.bingbaochow.cam"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

False Positive Scenarios for “ThreatFox: AsyncRAT IOCs” Rule

• Scenario: Legitimate Remote Administration via PowerShell

  • Context: System administrators frequently use PowerShell to execute remote scripts or query system health, which often involves network connections to internal management servers that match the AsyncRAT C2 domain patterns.
  • Suggested Filter/Exclusion: Exclude traffic where the source process is powershell.exe (or pwsh.exe) and the destination IP belongs to the internal “Management” subnet (e.g., 10.10.x.x). Additionally, filter out connections where the user context is a known Domain Admin group member.

• Scenario: Scheduled Backup Jobs Utilizing Cloud Storage

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik often initiate scheduled jobs that upload data to cloud repositories. These agents may use network ports and domain names similar to the AsyncRAT IOCs during their synchronization windows.
  • Suggested Filter/Exclusion: Create an exclusion for processes named VeeamAgent.exe or rubrik-agent.exe. Furthermore, suppress alerts generated between 02:00 and 06:00 local time (typical backup window) if the destination port is standard HTTPS (443) or a known backup service port.

• Scenario: Software Deployment via SCCM/Intune

  • Context: During peak deployment windows, tools like Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune push updates and scripts to endpoints. The communication between the client agent (ccmexec.exe or IntuneManagementExtension) and the distribution point can mimic the AsyncRAT beacon behavior.
  • Suggested Filter/Exclusion: Exclude alerts where the source process is