ThreatFox: Quasar RAT IOCs

Hunt Hypothesis

The ThreatFox: Quasar RAT IOCs rule detects potential indicators of a Quasar RAT deployment, which is a high-impact remote access trojan used for persistent, stealthy network control. SOC teams should proactively hunt for these IOCs in Azure Sentinel to identify and mitigate advanced persistent threats that could exfiltrate data or execute arbitrary commands within the environment.

IOC Summary

Malware Family: Quasar RAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Quasar RAT
let malicious_ips = dynamic(["38.45.126.243", "38.45.126.245"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["38.45.126.243", "38.45.126.245"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Quasar RAT

False Positive Guidance

• Scenario: Legitimate system update using wget to download a package from a trusted internal repository
  Filter/Exclusion: process.parent_process contains "yum" or "dnf" or "apt" or "zypper"

• Scenario: Scheduled backup job using rsync that transfers files to a remote server
  Filter/Exclusion: process.name contains "rsync" and destination_ip in internal_network_ranges

• Scenario: Admin performing a network scan using nmap to test firewall rules
  Filter/Exclusion: process.name contains "nmap" and source_ip in internal_network_ranges

• Scenario: System using curl to fetch a configuration file from a known internal API endpoint
  Filter/Exclusion: process.name contains "curl" and destination_ip in internal_network_ranges and request_uri contains "/config"

• Scenario: Log management tool like logrotate executing a script to rotate logs
  Filter/Exclusion: process.name contains "logrotate" or "rsyslog" or "syslog-ng"