ThreatFox: Quasar RAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the Quasar Remote Access Trojan (RAT) by identifying specific indicators of compromise such as unique file hashes and network connections that signal potential command-and-control communication or data exfiltration. The SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly identify early-stage infections, enabling swift containment before the RAT establishes persistence and escalates privileges within the environment.

IOC Summary

Malware Family: Quasar RAT Total IOCs: 3 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`194[.]59[.]30[.]130:5000`	botnet_cc	2026-07-28	100%
ip:port	`38[.]128[.]251[.]36:3000`	botnet_cc	2026-07-28	100%
ip:port	`91[.]199[.]133[.]59:1604`	botnet_cc	2026-07-28	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Quasar RAT
let malicious_ips = dynamic(["91.199.133.59", "38.128.251.36", "194.59.30.130"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["91.199.133.59", "38.128.251.36", "194.59.30.130"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Quasar RAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Quasar RAT IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

Scenario: Security Tool Communication with Threat Intelligence Feeds
- Context: Enterprise EDR agents (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) periodically query external threat intelligence platforms to update their local IOC databases. If the Quasar RAT IOCs include specific URLs, IP ranges, or file hashes that overlap with these vendor endpoints, legitimate polling traffic will trigger the rule.
- Suggested Filter/Exclusion: Create an exclusion based on the Process Name of the security agent (e.g., FalconSensor.exe, MsMpEng.exe) and filter out network connections where the destination IP belongs to the vendor’s known CIDR blocks or the process is running under a system account (SYSTEM).
Scenario: Scheduled Patching and Software Deployment via SCCM/Intune
- Context: During nightly maintenance windows, System Center Configuration Manager (SCCM) or Microsoft Intune deploys software updates. The deployment engine may download installer packages from internal distribution points that share the same hash signature or network fingerprint as one of the Quasar RAT IOCs, causing a match on file creation or network connection events.
- Suggested Filter/Exclusion: Exclude alerts where the Parent Process is identified as the deployment service (e.g., ccmexec.exe, IntuneManagementExtension.exe) and the event timestamp falls within the defined maintenance window (e.g., 02:00 – 04:00 UTC).
Scenario: Legitimate Admin Remote Management Sessions
- Context: IT administrators frequently use remote management tools like TeamViewer, AnyDesk, or Microsoft Remote Desktop to troubleshoot workstations. If an