ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving AsyncRAT remote access trojan indicators by monitoring for specific known IOCs within Azure Sentinel logs. Proactive hunting is essential to identify early-stage lateral movement and command-and-control communications before the malware establishes persistent footholds in critical endpoints.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 10 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["154.30.132.30", "159.203.69.210", "203.98.68.17", "130.12.182.39", "34.106.101.107", "207.32.217.227"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["154.30.132.30", "159.203.69.210", "203.98.68.17", "130.12.182.39", "34.106.101.107", "207.32.217.227"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule, including targeted filters and exclusions:

• Legitimate Endpoint Management Deployment: The deployment of a new patch or configuration via an Enterprise Mobility Management (EMM) tool like Microsoft Intune or Ivanti Neurons often triggers the AsyncRAT network connection IOC. These tools frequently utilize similar C2 communication patterns and specific TLS fingerprints that overlap with the threat signature.

  • Filter/Exclusion: Create a whitelist rule excluding traffic originating from the Intune Management Agent (Microsoft.IntuneManagement) process or the Ivanti Control Service when communicating to known Microsoft or Ivanti cloud endpoints, specifically filtering out the specific User-Agent strings associated with these management agents.

• Scheduled Remote Monitoring Tasks: A nightly scheduled job running a third-party remote monitoring agent, such as SolarWinds NPM or Datadog Agent, may initiate outbound connections that match the AsyncRAT IOCs. These agents often run under generic service accounts (e.g., svc_monitor) and establish persistent heartbeats that mimic RAT behavior.

  • Filter/Exclusion: Implement a process-based exclusion for the specific executable paths of these monitoring tools (e.g., C:\Program Files\Datadog Agent\bin\agent.exe or C:\Program Files\SolarWinds\NPM\bin\npmagent.exe) and exclude alerts generated by the service account svc_monitor during the maintenance window hours (02:00 – 04:00 UTC).

• Internal Software Development & CI/CD Pipelines: In a DevOps environment, build agents running on internal servers (e.g., Jenkins or GitLab Runner) often pull dependencies and push artifacts to external repositories. If these pipelines utilize specific containerized tools that match the