This hunt targets the presence of AsyncRAT, a remote access trojan frequently used by threat actors to establish persistent control and exfiltrate data from compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected hosts before the adversary can leverage the RAT for lateral movement or further payload execution.
Malware Family: AsyncRAT Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 52[.]47[.]77[.]229:1999 | botnet_cc | 2026-09-21 | 75% |
| ip:port | 52[.]47[.]77[.]229:6000 | botnet_cc | 2026-09-21 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["52.47.77.229"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["52.47.77.229"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Legacy Application Updates via Third-Party Installers: Many enterprise applications (e.g., Adobe Creative Suite, Java, or specific vendor-specific management agents) utilize installers or update scripts that may temporarily write to or execute from paths associated with AsyncRAT IOCs (such as C:\Users\Public\ or specific temporary directories) during the update process.
msiexec.exe, setup.exe, or vendor-specific installers like AdobeUpdate.exe) and the file path matches the specific IOC directory but the executable name matches the vendor’s known binary.Scheduled Cleanup Jobs in Shared Folders: IT departments often deploy scheduled tasks (via schtasks or Group Policy) that run cleanup scripts in shared network drives or user profile public folders to manage disk space. These jobs may create or delete files in locations flagged by AsyncRAT IOCs (e.g., C:\Users\Public\Downloads or specific temp subdirectories).
cmd.exe or powershell.exe and the command line contains known cleanup script names (e.g., cleanup.ps1, diskclean.bat) or originates from a trusted service account (e.g., DOMAIN\svc-itops).Development and QA Environments: Developers and QA engineers frequently test applications or deploy build artifacts to local user directories or public folders. They may use tools like dotnet, java, or node to run builds or tests that write to paths matching AsyncRAT IOCs (e.g., C:\Users\<User>\AppData\Local\Temp or specific project folders).