ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving AsyncRAT remote access trojan indicators by monitoring for specific network and endpoint signals linked to its known infrastructure. Proactively hunting for these IOCs in Azure Sentinel is critical because AsyncRAT’s advanced capabilities allow attackers to establish persistent, covert command-and-control channels that often evade standard signature-based detection until significant compromise occurs.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 9 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["217.60.97.106", "217.165.0.228", "196.251.107.131", "128.90.59.58", "203.98.68.29", "203.98.68.17", "186.169.88.130"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["217.60.97.106", "217.165.0.228", "196.251.107.131", "128.90.59.58", "203.98.68.29", "203.98.68.17", "186.169.88.130"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - AsyncRAT
let malicious_domains = dynamic(["nuevaera2026202620262026.duckdns.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

Here are specific false positive scenarios and suggested exclusions for the ThreatFox: AsyncRAT IOCs detection rule in an enterprise environment:

• Scenario: Enterprise Endpoint Protection Scans

  • Context: The AsyncRAT detection logic often flags specific file hashes or network connections associated with legitimate security tools. For instance, CrowdStrike Falcon or Microsoft Defender for Endpoint agents frequently download definition updates or telemetry data that match the IOCs (specifically certain SHA256 hashes or domain names) defined in the ThreatFox package.
  • Filter/Exclusion: Create a whitelist rule excluding process paths containing C:\Program Files\CrowdStrike\ and C:\ProgramData\Microsoft\Windows Defender\. Additionally, exclude outbound traffic to known Microsoft update domains (e.g., *.update.microsoft.com) if the IOC matches a specific hash used by their telemetry service.

• Scenario: Scheduled Remote Management Jobs

  • Context: IT administrators often use remote management tools like SCCM (System Center Configuration Manager) or Ansible Tower to deploy patches and scripts across the fleet. These tools may execute PowerShell scripts or C# binaries that generate network traffic and file artifacts identical to AsyncRAT’s command-and-control (C2) signatures, particularly during nightly maintenance windows.
  • Filter/Exclusion: Implement a time-based exclusion for alerts occurring between 01:00 and 05:00 UTC on the primary management server subnet. Alternatively, exclude process names such as ccmexec.exe (SCCM) and ansible-runner.exe, ensuring the user context is restricted to service accounts like DOMAIN\SCCM_Service.

• Scenario: Development Environment Build Artifacts

  • Context: In R&D departments, developers utilize build servers running Jenkins, GitLab Runner, or