This hunt detects adversary activity involving the AsyncRAT remote access tool by identifying matches against five specific indicators of compromise within Azure Sentinel logs. Proactively hunting for these signals is critical to uncover stealthy command-and-control communications and potential lateral movement that may evade standard signature-based detections.
Malware Family: AsyncRAT Total IOCs: 5 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 79[.]110[.]49[.]148:7777 | botnet_cc | 2026-07-24 | 75% |
| ip:port | 79[.]110[.]49[.]148:1009 | botnet_cc | 2026-07-24 | 75% |
| ip:port | 79[.]110[.]49[.]148:60 | botnet_cc | 2026-07-24 | 75% |
| ip:port | 157[.]20[.]182[.]22:4443 | botnet_cc | 2026-07-24 | 75% |
| ip:port | 157[.]20[.]182[.]21:4444 | botnet_cc | 2026-07-24 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["157.20.182.22", "157.20.182.21", "79.110.49.148"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["157.20.182.22", "157.20.182.21", "79.110.49.148"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:
Scenario: Legitimate Software Deployment via SCCM/Intune
setup.exe) matches one of the AsyncRAT IOCs because it shares a similar hash or filename pattern with known AsyncRAT variants.ccmexec.exe (SCCM) or Microsoft.IntuneManagementExtension.exe where the parent process is a trusted deployment agent and the file path resides within standard enterprise application directories (e.g., C:\Program Files\TeamViewer\).Scenario: Scheduled Antivirus Definition Updates
avupdate.exe) has a file hash that overlaps with an AsyncRAT IOC due to shared code libraries or similar build signatures from the same vendor ecosystem.TaskScheduler (specifically tasks named “AV Update Service”) and the execution time falls within the defined maintenance window (e.g., 02:00 – 04:00 local time). Additionally, whitelist the specific file path of the update module.Scenario: Admin Remote Session for Troubleshooting