ThreatFox: Quasar RAT IOCs

Hunt Hypothesis

This hunt detects adversaries deploying Quasar RAT to establish persistent remote access through phishing or compromised credentials, enabling data exfiltration and command execution via specific IP:port connections and hash-based payloads. The SOC team should proactively hunt for these indicators in Azure Sentinel to identify early-stage infections characterized by unusual outbound traffic and unexpected process executions before attackers can fully compromise the environment.

IOC Summary

Malware Family: Quasar RAT Total IOCs: 6 IOC Types: ip:port, sha1_hash, md5_hash, sha256_hash

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Quasar RAT
let malicious_ips = dynamic(["94.154.34.203", "134.122.200.212", "134.122.200.208"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["94.154.34.203", "134.122.200.212", "134.122.200.208"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Quasar RAT
let malicious_hashes = dynamic(["8ad256c5b786abb5f1552d906df3482a", "b3c2f9ac068664bb861d7f8a59db533810032bc26d75fad48dbd0e2ba26413b2", "c321593cb3d8e279dfbdcf6d8bb94fac93cdc405"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Quasar RAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Quasar RAT IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

• Legitimate RMM Agent Communication

  • Scenario: Enterprise Remote Monitoring and Management (RMM) tools like SolarWinds N-Age, ManageEngine Desktop Central, or TeamViewer frequently initiate outbound connections to their management servers using specific IP:port combinations that match Quasar’s network signatures. These agents also execute background processes (svchost.exe or custom service binaries) with hash values similar to the detection logic, often triggering alerts during routine health checks or software updates.
  • Filter/Exclusion: Create a whitelist rule excluding outbound traffic from known RMM server IPs and specific process hashes associated with approved management agents (e.g., ProcessHash = [Known_RMM_Hash] AND DestinationIP IN [RMM_Server_List]). Additionally, exclude the specific service names used by these tools in the process execution logs.

• Scheduled Backup and Data Synchronization Jobs

  • Scenario: Automated backup solutions such as Veeam, Rubrik, or cloud sync clients like OneDrive for Business and SharePoint often generate high-volume outbound traffic to transfer large data payloads. These jobs run via scheduled tasks (e.g., Task Scheduler entries named “DailyBackup”) that execute specific binary processes, mimicking the data exfiltration behavior of Quasar RAT.
  • Filter/Exclusion: Implement a time-based exclusion for known maintenance windows (e.g., 02:00–04:00 UTC) and filter out alerts where the parent process is Task Scheduler (svchost.exe -k netsvcs) executing specific backup binaries. Exclude traffic destined to public cloud storage endpoints (Azure, AWS S3, Office