ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt detects adversary behavior consistent with AsyncRAT malware by identifying network connections and file artifacts matching six specific Indicators of Compromise (IOCs). Proactively hunting for these signals in Azure Sentinel is critical to rapidly identify active remote access trojans that could enable long-term data exfiltration and command-and-control communications before they escalate into a full breach.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 6 IOC Types: ip:port, domain, md5_hash

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["2.59.132.84", "46.246.12.19", "198.23.185.95"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["2.59.132.84", "46.246.12.19", "198.23.185.95"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - AsyncRAT
let malicious_domains = dynamic(["xoso66edu.com", "vxoso66.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - AsyncRAT
let malicious_hashes = dynamic(["81961b2997cdf859ab8b96c3dd0afb07"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Scanning of Quarantined Archives

  • Scenario: The organization’s EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled deep scan of the C:\Quarantine directory. This directory contains archived versions of AsyncRAT samples previously flagged and isolated by security teams, triggering matches against the rule’s hash-based IOCs without indicating active infection.
  • Suggested Filter: Exclude file paths containing \Quarantine\, \Staging\, or \Archive\. Additionally, filter out events where the process name is the EDR scanner (e.g., C:\Program Files\CrowdStrike\fsagent.exe) rather than a user-facing application.

• Software Deployment via Configuration Management Tools

  • Scenario: The IT Operations team uses Microsoft SCCM or Ansible to deploy a legitimate internal utility tool named “AsyncConnect” (which shares a similar naming convention and potentially overlapping hash signatures with the AsyncRAT family) to 500 workstations. The deployment agent extracts the installer, triggering the detection logic during the installation phase.
  • Suggested Filter: Create an exclusion for processes initiated by known configuration management agents (e.g., ccmexec.exe, Ansible-Runner.exe) and whitelist specific file hashes associated with the internal “AsyncConnect” utility in the SIEM correlation rule.

• Scheduled Malware Analysis Job on Shared Drives

  • Scenario: A scheduled task runs nightly using a specialized tool like VirusTotal Enterprise API scanner or Symantec Endpoint Protection to analyze files on a shared network drive (\\FileServer\HR_Documents). This job processes a folder