ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving AsyncRAT remote access trojan activity by monitoring network connections and process executions against its known indicators of compromise. Proactively hunting for these specific IOCs in Azure Sentinel is critical to identify early-stage lateral movement and command-and-control communications before the malware establishes persistence or exfiltrates sensitive data.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["64.89.161.190", "198.23.185.95"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["64.89.161.190", "198.23.185.95"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Scanning of Quarantine Archives

  • Scenario: The organization’s EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a deep scan of the C:\ProgramData\Quarantine directory. This directory often contains archived samples from previous threat hunts, including benign versions of AsyncRAT used in internal training exercises or sandboxed test files that match the rule’s hash IOCs but are not active threats.
  • Suggested Filter: Exclude file paths containing Quarantine, TestSamples, or Sandbox directories. Additionally, filter out alerts where the process name is the EDR service itself (e.g., csagent.exe, MsMpEng.exe) rather than a user-facing application.

• IT Automation Scripts Deploying Remote Management Tools

  • Scenario: System administrators utilize Ansible or PowerShell Desired State Configuration (DSC) to deploy remote management agents across the fleet. During these scheduled nightly maintenance windows, the automation engine extracts and executes a legitimate version of AsyncRAT (or a tool sharing its signature) on target servers to verify connectivity before full deployment.
  • Suggested Filter: Create an exclusion for processes spawned by known automation engines (ansible-runner.exe, powershell.exe with specific command-line arguments containing -ExecutionPolicy Bypass) running during defined maintenance windows (e.g., 02:00–04:00 UTC).

• Software Deployment via SCCM/Intune

  • Scenario: The IT department uses Microsoft Endpoint Configuration Manager (MECM) or Microsoft Intune to push a software update package.