This hypothesis targets the presence of known AsyncRAT indicators of compromise, which are frequently deployed by threat actors to establish persistent remote access and execute malicious commands within the environment. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised endpoints before the adversary leverages the RAT for lateral movement or data exfiltration, thereby reducing the dwell time of high-severity threats.
Malware Family: AsyncRAT Total IOCs: 5 IOC Types: domain, ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 46[.]40[.]193[.]169:1723 | botnet_cc | 2026-09-22 | 75% |
| ip:port | 192[.]142[.]10[.]165:8808 | botnet_cc | 2026-09-22 | 75% |
| ip:port | 188[.]137[.]227[.]133:7707 | botnet_cc | 2026-09-22 | 75% |
| domain | spongebob.dynuddns.com | botnet_cc | 2026-09-22 | 75% |
| ip:port | 105[.]158[.]184[.]236:8808 | botnet_cc | 2026-09-22 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["46.40.193.169", "105.158.184.236", "192.142.10.165", "188.137.227.133"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["46.40.193.169", "105.158.184.236", "192.142.10.165", "188.137.227.133"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - AsyncRAT
let malicious_domains = dynamic(["spongebob.dynuddns.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Scenario: A DevOps team deploys a custom Python-based automation script for CI/CD pipeline cleanup that uses asyncio and aiohttp libraries, resulting in network connections to known AsyncRAT C2 domains (e.g., 185.154.246.190) for artifact fetching.
python.exe or python3.exe originating from the C:\Program Files\Jenkins\ or C:\opt\ci-runner\ directories, specifically when the parent process is jenkins.exe or runner-agent.Scenario: An IT administrator runs a scheduled PowerShell job to patch a legacy Java application server, which temporarily opens a debug port and connects to an external IP (e.g., 91.108.172.122) listed in the AsyncRAT IOC set for license validation or telemetry.
java.exe or javaw.exe where the parent process is powershell.exe and the command line contains -cp (classpath) or -jar, limited to accounts in the IT-Admins AD group.Scenario: A security engineer performs a manual red team exercise or vulnerability scan using a tool like nmap or masscan that probes a range of IPs including known AsyncRAT C2 nodes to verify firewall rules, causing the host to appear as if it is communicating with the threat.
nmap.exe, masscan.exe, or zmap.exe when the parent process is cmd.exe or powershell.exe and the user account belongs to the Security-RedTeam or Vulnerability-Scanners group