ThreatFox: AsyncRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior indicative of AsyncRAT remote access trojan activity by identifying specific indicators of compromise across network and endpoint telemetry within Azure Sentinel. Proactively hunting for these signatures is critical to detect early-stage lateral movement and command-and-control communications before the malware establishes persistent footholds in the environment.

IOC Summary

Malware Family: AsyncRAT Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`23[.]106[.]52[.]176:2489`	botnet_cc	2026-07-12	75%
ip:port	`23[.]106[.]52[.]176:3984`	botnet_cc	2026-07-12	75%
ip:port	`157[.]20[.]182[.]18:1665`	botnet_cc	2026-07-12	75%
ip:port	`104[.]164[.]46[.]55:62721`	botnet_cc	2026-07-12	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AsyncRAT
let malicious_ips = dynamic(["104.164.46.55", "157.20.182.18", "23.106.52.176"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["104.164.46.55", "157.20.182.18", "23.106.52.176"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AsyncRAT

False Positive Guidance

Here are four specific false positive scenarios for the ThreatFox: AsyncRAT IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Endpoint Protection Scanning of Quarantined Archives
- Scenario: The organization’s EDR (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled deep scan of the “Quarantine” folder on file servers. This folder contains archived versions of software installers and legacy executables that have been previously flagged by ThreatFox but are known to be benign in this specific context. The detection logic triggers because the EDR engine extracts these files, momentarily matching the AsyncRAT hash or network signature before re-quarantining them.
- Filter/Exclusion: Create an exclusion rule based on the process path of the scanning agent (e.g., C:\Program Files\CrowdStrike\fsagent.exe) and restrict the detection scope to exclude file paths containing \Quarantine\ or \Staging\.
Software Deployment via SCCM/Intune Pushing Known Updates
- Scenario: The IT operations team uses Microsoft Endpoint Configuration Manager (MECM) or Intune to push a critical security update for an internal application. This update package includes a third-party runtime library that shares a specific hash with the AsyncRAT IOCs. When the deployment agent (ccmexec.exe or Microsoft.IntuneManagementExtension) executes the installer on thousands of endpoints simultaneously, it generates high-volume alerts matching the IOC signatures during the installation phase.
- Filter/Exclusion: Implement an exclusion based on the parent process name (e.g., ccmexec.exe, IntuneManagementExtension.exe) and correlate with a specific scheduled task name (e.g., “SoftwareUpdateDeployment_042”) to suppress alerts originating from these