This hunt targets adversaries deploying the AsyncRAT remote access trojan to establish persistent command-and-control channels and exfiltrate sensitive data from endpoints. Proactively searching for these specific IOCs within Azure Sentinel is critical because early detection of this high-severity threat prevents lateral movement and mitigates the risk of long-term unauthorized access before full compromise occurs.
Malware Family: AsyncRAT Total IOCs: 3 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 192[.]227[.]219[.]71:34471 | botnet_cc | 2026-07-20 | 75% |
| ip:port | 147[.]93[.]191[.]75:20800 | botnet_cc | 2026-07-20 | 75% |
| ip:port | 147[.]93[.]191[.]75:20700 | botnet_cc | 2026-07-20 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["192.227.219.71", "147.93.191.75"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["192.227.219.71", "147.93.191.75"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule in an enterprise environment, including suggested filters and exclusions:
Software Deployment via SCCM/Intune Agents
AsyncRAT executable as a legitimate component for remote troubleshooting agents. When these agents initiate background health checks, they may match the specific file hash or network signature associated with AsyncRAT IOCs.10.20.x.x) or filter by parent process names such as ccmexec.exe (SCCM) or Microsoft.Workplace.Joiner.Scheduled Remote Desktop Maintenance Jobs
AsyncRAT_Console.exe to verify connectivity and gather system metrics during off-hours (e.g., 2:00 AM daily). This legitimate administrative job triggers the rule due to its matching process name and outbound connection patterns.Task Scheduler (svchost.exe or taskschd.msc) with a command line argument containing specific maintenance tags (e.g., -task_id=MAINT_042).Third-Party ITSM Ticketing System Integration