ThreatFox: Quasar RAT IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of Quasar Remote Access Trojan (RAT) by monitoring network and endpoint logs for three specific Indicators of Compromise (IOCs). Proactively hunting for these IOCs in Azure Sentinel is critical to identify early-stage lateral movement and command-and-control communications that could enable persistent access to sensitive corporate assets.

IOC Summary

Malware Family: Quasar RAT Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`1e41d13dacd614db30c0627974e5f593`	payload	2026-08-15	95%
sha256_hash	`ddf9f33fc318bc91eea94a4046a2f03d36652057b9d0f5b985ce81ce4061c4e6`	payload	2026-08-15	95%
sha1_hash	`509b938cc18aadc1c0cb0dcfa27a50845837d13e`	payload	2026-08-15	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Quasar RAT
let malicious_hashes = dynamic(["1e41d13dacd614db30c0627974e5f593", "ddf9f33fc318bc91eea94a4046a2f03d36652057b9d0f5b985ce81ce4061c4e6", "509b938cc18aadc1c0cb0dcfa27a50845837d13e"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Quasar RAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Quasar RAT IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

Scenario: Endpoint Security Agent Updates
- Context: The organization’s primary endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs scheduled signature updates. These agents often download large definition files that match the hash signatures of Quasar RAT components due to shared code libraries or similar compression algorithms used in the update packages.
- Filter/Exclusion: Create an exclusion based on the specific process names of the security agent (e.g., FalconSensor.exe, MsMpEng.exe) and restrict the detection scope to exclude file paths within the vendor’s installation directory (e.g., C:\Program Files\CrowdStrike\ or C:\ProgramData\Microsoft\Malware Protection).
Scenario: Automated Software Deployment via SCCM/Intune
- Context: During nightly maintenance windows, System Center Configuration Manager (SCCM) or Microsoft Intune pushes a standardized software bundle to workstations. The deployment package includes a utility tool that utilizes the same cryptographic hash as one of the Quasar IOCs, triggering an alert when the installer extracts temporary files to the user’s %TEMP% directory.
- Filter/Exclusion: Implement a logic filter that suppresses alerts originating from known deployment service accounts (e.g., NT SERVICE\CCMExec) or specific process trees initiated by ccmsetup.exe. Additionally, exclude file paths matching the pattern C:\Windows\CCM\ and C:\Users\<User>\AppData\Local\Temp\*.
Scenario: Legacy Backup Agent Operations
- Context: The enterprise utilizes a legacy backup solution (e.g., Veeam or Acron