The ThreatFox: AsyncRAT IOCs rule detects potential command and control communication associated with the AsyncRAT malware, which is known for its persistence and data exfiltration capabilities. SOC teams should proactively hunt for these IOCs in Azure Sentinel to identify and mitigate advanced persistent threats before they cause significant data loss or network compromise.
IOC Summary
Malware Family: AsyncRAT Total IOCs: 17 IOC Types: domain, ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 45[.]81[.]243[.]44:7089 | botnet_cc | 2026-06-19 | 75% |
| ip:port | 211[.]235[.]43[.]192:7707 | botnet_cc | 2026-06-19 | 75% |
| ip:port | 205[.]209[.]106[.]158:5228 | botnet_cc | 2026-06-19 | 75% |
| ip:port | 198[.]23[.]185[.]136:60 | botnet_cc | 2026-06-19 | 75% |
| ip:port | 102[.]220[.]160[.]222:2025 | botnet_cc | 2026-06-19 | 75% |
| domain | tasknew35630.duckdns.org | botnet_cc | 2026-06-19 | 75% |
| domain | bogota123.duckdns.org | botnet_cc | 2026-06-19 | 75% |
| ip:port | 66[.]118[.]237[.]171:8808 | botnet_cc | 2026-06-19 | 100% |
| ip:port | 91[.]92[.]242[.]67:7707 | botnet_cc | 2026-06-19 | 75% |
| ip:port | 45[.]32[.]66[.]51:6606 | botnet_cc | 2026-06-19 | 75% |
| ip:port | 198[.]23[.]185[.]82:7777 | botnet_cc | 2026-06-19 | 75% |
| ip:port | 147[.]93[.]191[.]75:30700 | botnet_cc | 2026-06-19 | 75% |
| ip:port | 102[.]220[.]160[.]217:7707 | botnet_cc | 2026-06-19 | 75% |
| domain | porkitao08.duckdns.org | botnet_cc | 2026-06-19 | 100% |
| ip:port | 198[.]23[.]185[.]136:8808 | botnet_cc | 2026-06-19 | 100% |
| ip:port | 198[.]23[.]185[.]136:3000 | botnet_cc | 2026-06-19 | 100% |
| ip:port | 192[.]140[.]175[.]194:8808 | botnet_cc | 2026-06-19 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["198.23.185.136", "198.23.185.82", "102.220.160.217", "45.81.243.44", "205.209.106.158", "91.92.242.67", "45.32.66.51", "66.118.237.171", "211.235.43.192", "147.93.191.75", "102.220.160.222", "192.140.175.194"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["198.23.185.136", "198.23.185.82", "102.220.160.217", "45.81.243.44", "205.209.106.158", "91.92.242.67", "45.32.66.51", "66.118.237.171", "211.235.43.192", "147.93.191.75", "102.220.160.222", "192.140.175.194"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - AsyncRAT
let malicious_domains = dynamic(["tasknew35630.duckdns.org", "bogota123.duckdns.org", "porkitao08.duckdns.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Scenario: Legitimate scheduled job for system cleanup using Sysinternals Process Explorer
Filter/Exclusion: Exclude processes with Image containing ProcessExplorer.exe or Sysinternals in the file path.
Scenario: Admin task using PowerShell to generate temporary files for log analysis
Filter/Exclusion: Exclude processes with Image containing powershell.exe and Command containing -Command or -File with known log analysis scripts.
Scenario: Use of Windows Task Scheduler to run a legitimate maintenance script
Filter/Exclusion: Exclude tasks with TaskName containing “Maintenance” or “Cleanup” and Image matching known benign scripts.
Scenario: Network discovery tool Nmap scanning internal network for security assessment
Filter/Exclusion: Exclude processes with Image containing nmap.exe and DestinationPort in the range of common internal ports (e.g., 1-1023).
Scenario: Use of Wireshark for packet capture and analysis by the security team
Filter/Exclusion: Exclude processes with Image containing wireshark.exe and ProcessName matching the security team’s user account.