This hunt detects adversary activity involving AsyncRAT remote access trojan indicators, which are frequently used to establish persistent command-and-control channels and exfiltrate sensitive data from compromised endpoints. Proactively hunting for these specific IOCs in Azure Sentinel is critical to identify early-stage intrusions before attackers can leverage the tool’s advanced stealth capabilities to maintain long-term access within the environment.
Malware Family: AsyncRAT Total IOCs: 8 IOC Types: sha256_hash, ip:port, md5_hash, sha1_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 157[.]20[.]182[.]21:6666 | botnet_cc | 2026-07-25 | 75% |
| ip:port | 196[.]251[.]107[.]131:6606 | botnet_cc | 2026-07-25 | 75% |
| ip:port | 146[.]103[.]38[.]224:7707 | botnet_cc | 2026-07-25 | 75% |
| ip:port | 103[.]67[.]163[.]201:6606 | botnet_cc | 2026-07-25 | 75% |
| ip:port | 2[.]50[.]171[.]117:8808 | botnet_cc | 2026-07-25 | 100% |
| sha1_hash | 1b5660a17955bd0a20ab8ee084395f2c05bbfae3 | payload | 2026-07-25 | 95% |
| md5_hash | d29fb7ad2a20bea506c8c3776e90707e | payload | 2026-07-25 | 95% |
| sha256_hash | e77b0473ee512fa6121b864bc0e7003ef3fffda2e7a612941a10a8d6c83c68a1 | payload | 2026-07-25 | 95% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["2.50.171.117", "103.67.163.201", "196.251.107.131", "157.20.182.21", "146.103.38.224"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["2.50.171.117", "103.67.163.201", "196.251.107.131", "157.20.182.21", "146.103.38.224"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - AsyncRAT
let malicious_hashes = dynamic(["1b5660a17955bd0a20ab8ee084395f2c05bbfae3", "d29fb7ad2a20bea506c8c3776e90707e", "e77b0473ee512fa6121b864bc0e7003ef3fffda2e7a612941a10a8d6c83c68a1"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceFileEvents | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:
Scenario: Software Deployment via SCCM/Intune
Microsoft Corporation or SCCM) and the Process Command Line. Filter out events where the process path contains \Microsoft Endpoint Configuration Manager\ or \IntuneManagementExtension\, ensuring only unsigned or non-standard paths trigger alerts.Scenario: Scheduled Maintenance Job for Remote Support Tools
Task Scheduler) running nightly at 02:00 to update remote support agents. This job executes a script that establishes network connections and downloads configuration files, which mimics the IOCs of AsyncRAT’s command-and-control (C2) behavior.svchost.exe or TaskSchedulerService. Additionally, exclude traffic originating from known internal IP ranges (e.g., 10.20.x.x) that are designated for the Helpdesk VLAN.Scenario: Development Environment Testing of Legacy Applications