ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving three specific indicators of compromise (IOCs) linked to the AsyncRAT remote access tool, which is frequently used by threat actors for command and control operations. The SOC team should proactively search for these IOCs in Azure Sentinel to identify early-stage lateral movement or persistent backdoor access before attackers can establish a foothold within the environment.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["160.30.20.216", "103.67.163.201", "157.20.182.22"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["160.30.20.216", "103.67.163.201", "157.20.182.22"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

• Endpoint Protection Scanning of Quarantine Folders

  • Scenario: The organization’s endpoint protection suite (e.g., Microsoft Defender Antivirus or CrowdStrike Falcon) performs a scheduled deep scan on the C:\ProgramData\ThreatFox\Quarantine directory. This process generates network traffic and file hashes that match AsyncRAT signatures because the quarantine folder contains archived samples of previously detected AsyncRAT variants, triggering the rule during routine maintenance windows.
  • Filter/Exclusion: Exclude processes where ProcessName equals MsMpEng.exe or Csfalcon.exe AND SourcePath contains \Quarantine\. Additionally, apply a time-based filter to suppress alerts generated between 02:00 and 04:00 UTC on weekdays.

• IT Admin Deployment of Security Tools via SCCM

  • Scenario: System administrators use Microsoft Endpoint Configuration Manager (SCCM/MECM) to push security updates or install new monitoring agents across the fleet. During this deployment, the installer package (AsyncRAT_Installer.msi) is executed by ccmexec.exe and extracts temporary files that match AsyncRAT IOCs before being cleaned up, causing a spike in detection hits.
  • Filter/Exclusion: Create an exclusion for any event where the ParentProcessName is ccmexec.exe or wuauserv.exe. Furthermore, filter out events where the CommandLine contains arguments related to /quiet, /norestart, or specific SCCM application GUIDs associated with security tooling.

• Scheduled Database Backup Jobs Utilizing AsyncRAT Components

  • Scenario: The