ThreatFox: Quasar RAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the Quasar Remote Access Trojan (RAT) by identifying specific Indicators of Compromise (IOCs) that signal potential command-and-control communications or malicious process execution within the environment. A proactive search is essential in Azure Sentinel to rapidly identify and isolate compromised endpoints before attackers can leverage this RAT for long-term persistence, credential theft, and lateral movement across the network.

IOC Summary

Malware Family: Quasar RAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Quasar RAT
let malicious_ips = dynamic(["5.83.150.71", "145.63.135.73"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["5.83.150.71", "145.63.135.73"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Quasar RAT

False Positive Guidance

False Positive Scenarios for “ThreatFox: Quasar RAT IOCs” Rule

• Scenario: Endpoint Protection Engine Updates

  • Context: The organization utilizes CrowdStrike Falcon or Microsoft Defender for Endpoint. During the nightly maintenance window (e.g., 02:00 AM), the agent updates its signature database and telemetry modules. These background processes often spawn network connections to update servers that match the IP ranges or domain hashes associated with Quasar RAT’s command-and-control infrastructure.
  • Suggested Filter: Exclude traffic originating from the specific process C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe (or equivalent for Defender) when connecting to known update server domains (e.g., *.crowdstrike.com, *.microsoft.com) during the defined maintenance window.

• Scenario: Scheduled Backup and Synchronization Jobs

  • Context: A scheduled task running via Windows Task Scheduler executes a daily backup using Veeam Agent for Microsoft Windows or Acronis Cyber Protect. These tools frequently utilize cloud storage endpoints (e.g., AWS S3, Azure Blob) that share similar TLS certificate fingerprints or IP subnets with the Quasar RAT IOCs, triggering alerts during high-volume data transfer periods.
  • Suggested Filter: Create an exclusion rule for processes named veeamagent.exe and acronisbackupservice.exe when they initiate outbound connections to specific cloud storage CIDR blocks identified in the backup configuration, specifically excluding the alert if the connection duration exceeds 5 minutes (indicating a transfer rather than a beacon).

• Scenario: Legacy Remote Management Tools

  • Context: The IT Operations team uses TeamViewer or AnyDesk for remote support on legacy servers. These tools maintain persistent background services that periodically “phone home” to their central management