ThreatFox: Quasar RAT IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of Quasar Remote Access Trojan (RAT) by monitoring for specific Indicators of Compromise that enable persistent command and control capabilities within the environment. A SOC team should proactively hunt for these IOCs in Azure Sentinel to identify early-stage lateral movement or data exfiltration attempts before the attacker establishes a deeper foothold.

IOC Summary

Malware Family: Quasar RAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Quasar RAT
let malicious_ips = dynamic(["185.194.30.165", "149.30.232.214"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["185.194.30.165", "149.30.232.214"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Quasar RAT

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: Quasar RAT IOCs detection rule in an enterprise environment:

• Scenario: Security Tool Internal Communication

  • Context: Enterprise Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, often utilize known IOCs (hashes or domains) that overlap with the Quasar RAT signature database. When these agents perform routine telemetry uploads or policy synchronization, they may match a specific hash or network domain associated with the rule.
  • Filter/Exclusion: Create an exclusion list based on the Process Name and User Context. Add a filter to exclude alerts where the process is C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe (or equivalent EDR agent paths) AND the user context is SYSTEM or a dedicated service account like svc-edr-agent, as these processes are trusted and unlikely to be compromised by an external RAT.

• Scenario: Scheduled Backup and Archiving Jobs

  • Context: Automated backup solutions, such as Veeam Backup & Replication or Commvault, frequently generate large files with specific hashes during nightly windows. If the Quasar rule includes a file hash that coincidentally matches a common library used by these backup engines (e.g., a shared compression DLL), the detection will trigger during the scheduled maintenance window.
  • Filter/Exclusion: Implement a time-based exclusion or a parent-process filter. Configure the rule to suppress alerts occurring between 01:00 and 05:00 UTC where the Parent Process Name is vbrsrv.exe (Veeam) or commvault.cmd. Additionally, exclude specific file paths known to be backup destinations, such as D:\Backup\Archives\*.