ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt detects adversary behavior characterized by the execution of AsyncRAT remote access trojan components, specifically targeting known indicators of compromise such as malicious process creation and network beaconing. Proactively hunting for these IOCs in Azure Sentinel is critical to identify early-stage lateral movement and data exfiltration attempts before they escalate into full-scale breaches within the organization’s cloud infrastructure.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["107.174.142.104", "192.162.199.149", "34.181.236.49"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["107.174.142.104", "192.162.199.149", "34.181.236.49"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AsyncRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule in an enterprise environment, along with recommended filters or exclusions:

• Endpoint Protection Scanning of Legacy Archives

  • Scenario: The organization’s EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a deep scan of a shared network drive containing legacy software installers. These archives contain older versions of AsyncRAT used for internal remote support, triggering the hash-based IOCs within the detection logic even though no active infection exists on the host.
  • Filter/Exclusion: Create an exclusion based on process lineage where ParentProcessName is the EDR scanner (e.g., csagent.exe, MsMpEng.exe) and the file path contains known archive extensions (*.zip, *.7z, *.cab).

• IT Helpdesk Remote Support Sessions

  • Scenario: The IT Service Desk utilizes a legitimate, whitelisted instance of AsyncRAT (or a tool sharing similar binary hashes) to troubleshoot user workstations. When an analyst initiates a remote session from the “HelpDesk-Admin” OU, the agent executable launches and communicates with the command-and-control server, matching the network connection IOCs defined in the rule.
  • Filter/Exclusion: Exclude events where the SourceUser belongs to the IT-Support or Helpdesk-Admin security groups, combined with a filter for known administrative source IP ranges (e.g., 10.20.50.x).

• Scheduled Software Deployment via SCCM/Intune

  • Scenario: A scheduled task managed by Microsoft Endpoint Configuration Manager (SCCM) or Intune deploys the AsyncRAT agent to a fleet of new laptops during off-hours. The deployment script extracts and executes the installer,