ThreatFox: Quasar RAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the Quasar Remote Access Trojan (RAT) by identifying specific Indicators of Compromise (IOCs) that signal potential command-and-control communications or malicious file execution within the environment. Proactive hunting for these IOCs in Azure Sentinel is critical to rapidly identify and contain stealthy post-compromise operations, preventing attackers from establishing persistent access to sensitive data before broader detection mechanisms trigger.

IOC Summary

Malware Family: Quasar RAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Quasar RAT
let malicious_ips = dynamic(["154.39.106.153", "103.27.109.233"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["154.39.106.153", "103.27.109.233"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Quasar RAT

False Positive Guidance

Here are specific false positive scenarios and corresponding mitigation strategies for the ThreatFox: Quasar RAT IOCs detection rule:

• Scenario 1: Automated Patch Deployment via SCCM/Intune

  • Context: Enterprise endpoints running Microsoft Endpoint Configuration Manager (SCCM) or Intune often download and execute patching agents that communicate with external update servers. If the Quasar RAT signature matches a hash or network pattern used by these legitimate deployment tools during off-hours, it triggers an alert.
  • Filter/Exclusion: Create a whitelist exclusion for the specific process names (e.g., ccmsetup.exe, IntuneAgent.exe) and their associated parent processes running under the SYSTEM account. Additionally, exclude traffic from known internal update server IP ranges used by the organization’s patching infrastructure.

• Scenario 2: Scheduled Backup Jobs Executing Cloud Sync

  • Context: Automated backup solutions like Veeam Agent or Acronis Cyber Protect often run scheduled jobs that establish persistent connections to cloud storage providers (e.g., AWS S3, Azure Blob). These tools may utilize network ports and connection patterns similar to Quasar RAT’s command-and-control (C2) behavior.
  • Filter/Exclusion: Implement a rule exclusion based on the specific hash of the backup agent executable (e.g., VeeamAgent.exe) when it is initiated by a scheduled Windows Task (Task Scheduler > “Backup Job”). Exclude network destinations that are verified public cloud storage endpoints used by the organization.

• Scenario 3: Admin Remote Management Sessions

  • Context: IT administrators frequently use remote management tools such as BeyondTrust, Ivanti, or Microsoft System Center Operations Manager (SCOM) to push configurations or scripts to endpoints. These tools often inject processes that mimic RAT behavior by establishing bidirectional communication channels with the management server.