ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This detection rule identifies adversary activity associated with the AsyncRAT remote access tool by matching observed indicators against known ThreatFox intelligence feeds. A proactive hunt for these IOCs in Azure Sentinel is critical to uncover stealthy command-and-control communications and potential lateral movement that may evade standard signature-based defenses.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`198[.]37[.]105[.]30:7777`	botnet_cc	2026-08-09	75%
ip:port	`130[.]12[.]182[.]39:2700`	botnet_cc	2026-08-09	75%
ip:port	`216[.]128[.]131[.]6:8808`	botnet_cc	2026-08-09	100%
ip:port	`207[.]189[.]23[.]189:8808`	botnet_cc	2026-08-09	100%
ip:port	`159[.]203[.]69[.]210:48202`	botnet_cc	2026-08-08	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["198.37.105.30", "207.189.23.189", "159.203.69.210", "216.128.131.6", "130.12.182.39"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["198.37.105.30", "207.189.23.189", "159.203.69.210", "216.128.131.6", "130.12.182.39"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

Scenario: Automated Endpoint Security Scans
- Context: Enterprise EDR agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently download definition updates or perform heuristic scans that involve network connections to known security vendor domains. If the AsyncRAT IOCs include specific hash signatures or domain patterns used by these vendors, legitimate update traffic may trigger alerts.
- Filter/Exclusion: Create a rule exclusion based on the Process Name of the EDR agent (e.g., CrowdStrike.exe, MsMpEng.exe) and exclude traffic originating from the specific Source IP ranges assigned to the security management servers.
Scenario: Scheduled Software Deployment via SCCM/Intune
- Context: System Center Configuration Manager (SCCM) or Microsoft Intune often deploys applications during maintenance windows. These deployments may involve downloading installers from internal repositories that share similar network signatures or certificate chains with the AsyncRAT indicators, particularly if the deployment involves remote execution scripts.
- Filter/Exclusion: Exclude alerts where the Parent Process is ccmexec.exe (SCCM) or IntuneManagementExtension.exe, and filter out events occurring during defined Maintenance Windows (e.g., 02:00–04:00 local time).
Scenario: Remote Administration via PowerShell Remoting
- Context: IT administrators frequently use PowerShell (powershell.exe) to run remote scripts against multiple servers. If the AsyncRAT detection logic flags specific command-line arguments or network ports (e.g., port 80/443 connections from admin workstations) that match the RAT’s behavior,