ThreatFox: Quasar RAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the ten specific indicators of compromise (IOCs) associated with the Quasar Remote Access Trojan (RAT), which is frequently used for credential theft and lateral movement. A SOC team should proactively hunt for these IOCs in Azure Sentinel to identify early-stage infections before attackers can establish persistent access or exfiltrate sensitive data from the environment.

IOC Summary

Malware Family: Quasar RAT Total IOCs: 10 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`89[.]45[.]45[.]149:4785`	botnet_cc	2026-09-01	50%
ip:port	`159[.]223[.]5[.]148:4782`	botnet_cc	2026-09-01	50%
ip:port	`91[.]92[.]40[.]195:4782`	botnet_cc	2026-09-01	50%
ip:port	`45[.]113[.]1[.]190:4782`	botnet_cc	2026-09-01	50%
ip:port	`187[.]209[.]68[.]66:4782`	botnet_cc	2026-09-01	50%
ip:port	`86[.]250[.]101[.]142:4782`	botnet_cc	2026-09-01	50%
ip:port	`209[.]90[.]233[.]39:4782`	botnet_cc	2026-09-01	50%
ip:port	`105[.]108[.]202[.]236:288`	botnet_cc	2026-09-01	50%
ip:port	`107[.]175[.]0[.]152:15000`	botnet_cc	2026-09-01	50%
ip:port	`177[.]2[.]16[.]126:14782`	botnet_cc	2026-09-01	50%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Quasar RAT
let malicious_ips = dynamic(["187.209.68.66", "177.2.16.126", "45.113.1.190", "86.250.101.142", "107.175.0.152", "89.45.45.149", "159.223.5.148", "105.108.202.236", "209.90.233.39", "91.92.40.195"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["187.209.68.66", "177.2.16.126", "45.113.1.190", "86.250.101.142", "107.175.0.152", "89.45.45.149", "159.223.5.148", "105.108.202.236", "209.90.233.39", "91.92.40.195"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Quasar RAT

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Quasar RAT IOCs detection rule:

Scenario: Scheduled Endpoint Protection Scans
- Context: Enterprise antivirus solutions like CrowdStrike Falcon or Microsoft Defender for Endpoint (MDE) frequently update their definition databases. The update mechanism often downloads and executes a specific hash that matches one of the Quasar RAT IOCs, particularly if the vendor uses a shared code signing certificate or similar binary structure.
- Filter/Exclusion: Create an exclusion rule based on the Process Name (e.g., C:\Program Files\CrowdStrike\fsq.exe) and Parent Process ID. Exclude alerts where the parent process is the known AV service (ccSvcHst.exe or MsMpEng.exe) running under a System account.
Scenario: Automated Patch Management Deployments
- Context: IT administrators utilize tools like Microsoft Endpoint Configuration Manager (MECM/SCCM) or Jamf Pro to push security patches and software updates during maintenance windows. These deployment agents often spawn temporary processes that download payloads from internal repositories, which may generate network traffic patterns or file hashes identical to the Quasar RAT IOCs.
- Filter/Exclusion: Implement a logic filter excluding events where the Source IP belongs to the internal patch management server subnet (e.g., 10.x.x.x) and the Process Command Line contains keywords such as “Deployment,” “Patch,” or specific SCCM task sequence IDs.
Scenario: Legitimate Remote Administration Sessions
- Context: Helpdesk technicians performing remote troubleshooting using Microsoft System Center Configuration Manager (SCCM) or BeyondTrust often initiate remote control sessions that involve establishing persistent connections and executing diagnostic scripts. These activities can mimic the command-and-control (C2