ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving AsyncRAT remote access trojan indicators to identify potential command-and-control communications and lateral movement within the environment. A proactive search in Azure Sentinel is essential because AsyncRAT enables attackers to establish persistent footholds that can silently exfiltrate sensitive data before triggering standard alert thresholds.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["159.203.69.210"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["159.203.69.210"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule, along with recommended filters and exclusions tailored for an enterprise environment:

• Scenario: Security Team Manual IOC Hunting via EDR Query

  • Context: SOC analysts or threat hunters manually querying the Endpoint Detection and Response (EDR) console (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) to verify specific AsyncRAT hashes identified in a recent ThreatFox feed. This generates legitimate process executions matching the rule’s IOCs during the investigation window.
  • Filter/Exclusion: Create an exclusion based on the User Account and Process Name. Exclude alerts where the LogonUser is a member of the “SOC-Admins” or “Threat-Hunters” security group, and the initiating process is the EDR agent itself (e.g., MsMpEng.exe, FalconSensorService.exe) rather than a standard user application.

• Scenario: Scheduled Vulnerability Scanning Job

  • Context: A nightly scheduled job using an enterprise vulnerability scanner (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) runs across the network to assess endpoint posture. The scanner’s agent or remote execution engine may spawn processes that match AsyncRAT IOCs while scanning specific file paths or registry keys on target hosts.
  • Filter/Exclusion: Implement a time-based exclusion combined with a process signature filter. Exclude alerts occurring between 01:00 and 05:00 (local server time) where the parent process is the vulnerability scanner agent (e.g., TenableAgent.exe, QualysPCCAgent.exe) and the execution path resides within the vendor’s installation directory (e.g., C:\Program Files\Tenable\).

• **Scenario: Deployment of