This rule detects the presence of AsyncRAT, a remote access trojan, by matching known indicators of compromise to identify compromised endpoints within the Azure Sentinel environment. Proactively hunting for these IOCs is critical because AsyncRAT provides adversaries with persistent remote control capabilities, enabling them to execute commands, steal data, and establish footholds that may otherwise go unnoticed in standard monitoring.
Malware Family: AsyncRAT Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 143[.]246[.]43[.]117:80 | botnet_cc | 2026-09-23 | 75% |
| ip:port | 104[.]243[.]248[.]63:3603 | botnet_cc | 2026-09-23 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["143.246.43.117", "104.243.248.63"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["143.246.43.117", "104.243.248.63"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Legacy Java Application Maintenance: A legacy internal web application (e.g., built on Spring Boot or Tomcat) is updated to a new version that includes a specific JAR file or native library matching the hash or path pattern of an AsyncRAT component. This is common in environments where developers bundle third-party libraries or use specific build artifacts that overlap with known RAT IOCs.
C:\Apps\LegacyWebApp\lib\ or C:\Program Files\InternalTools\) or whitelist specific SHA256 hashes of the legitimate JARs/libraries used in the build pipeline.Scheduled Backup or Log Rotation Jobs: A scheduled task (e.g., via Windows Task Scheduler or cron) runs a script or utility that copies or moves log files or backup archives to a network share or local folder. If the backup tool or the specific archive name matches an AsyncRAT IOC (such as a generic name like config.dat or a specific path structure), it may trigger the rule.
BACKUP-SVC or LOG-ROTATION) or exclude specific file extensions (e.g., .zip, .tar.gz) in backup directories (e.g., D:\Backups\, \\fileserver\backups\) from the IOC matching logic.Development and Testing Environments: Developers or QA engineers run local instances of AsyncRAT or similar tools for testing, debugging, or training purposes in isolated dev VMs or containers. These environments often run the RAT from temporary directories or use non-standard paths that match the IOC list.
Environment=Dev or Environment=Test in CMDB/asset management, or