ThreatFox: Quasar RAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the Quasar Remote Access Trojan (RAT) by monitoring for specific indicators of compromise that signal potential command-and-control communication or lateral movement within the network. Proactively hunting for these IOCs in Azure Sentinel is critical to identify early-stage infections and prevent attackers from establishing persistent access to sensitive systems before they can exfiltrate data or execute malicious payloads.

IOC Summary

Malware Family: Quasar RAT Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Quasar RAT
let malicious_ips = dynamic(["5.83.145.69", "27.50.29.181", "103.101.85.103"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["5.83.145.69", "27.50.29.181", "103.101.85.103"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Quasar RAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Quasar RAT IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Security Tool Telemetry Collection

  • Context: Endpoint Detection and Response (EDR) agents or SIEM forwarders often perform periodic health checks that generate network traffic matching Quasar RAT signatures. Specifically, tools like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Splunk Universal Forwarder may initiate outbound connections to their respective cloud management consoles using ports or User-Agent strings similar to the detected IOCs.
  • Suggested Filter/Exclusion: Create an exclusion rule based on the Process Name and Destination IP. Exclude traffic originating from known security processes (e.g., C:\Program Files\CrowdStrike\fsquarant.exe, C:\Windows\System32\MsMpEng.exe) communicating with verified vendor cloud endpoints (e.g., *.falcon.crowdstrike.com or *.microsoftonline.com).

• Scenario: Scheduled Backup and Sync Operations

  • Context: Enterprise backup solutions frequently utilize scheduled tasks to sync data to the cloud, which can mimic the command-and-control (C2) behavior of Quasar RAT. For instance, a Veeam Backup & Replication job or a OneDrive for Business sync task running via Task Scheduler might trigger network connections that match the rule’s IOCs regarding specific HTTP/HTTPS headers or packet sizes.
  • Suggested Filter/Exclusion: Implement an exclusion based on Scheduled Task Name and Source Process Path. Exclude alerts where the source process is located in standard backup directories (e.g., C:\Program Files\Veeam\, C:\Users\<User>\AppData\Local\Microsoft\OneDrive) and the execution