ThreatFox: Quasar RAT IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of Quasar Remote Access Trojan (RAT) by identifying eight specific indicators of compromise that facilitate persistent access and command-and-control communication. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly identify early-stage infections, prevent lateral movement, and mitigate potential data exfiltration before the adversary establishes a long-term foothold within the environment.

IOC Summary

Malware Family: Quasar RAT Total IOCs: 8 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`118[.]25[.]188[.]245:4782`	botnet_cc	2026-08-21	75%
ip:port	`186[.]169[.]78[.]50:6001`	botnet_cc	2026-08-21	75%
ip:port	`186[.]169[.]78[.]50:1100`	botnet_cc	2026-08-21	75%
ip:port	`178[.]16[.]52[.]169:4782`	botnet_cc	2026-08-21	75%
ip:port	`207[.]189[.]15[.]159:4782`	botnet_cc	2026-08-21	75%
ip:port	`198[.]12[.]83[.]91:4782`	botnet_cc	2026-08-21	75%
ip:port	`217[.]156[.]65[.]42:4782`	botnet_cc	2026-08-21	75%
ip:port	`118[.]25[.]103[.]144:8888`	botnet_cc	2026-08-21	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Quasar RAT
let malicious_ips = dynamic(["217.156.65.42", "118.25.103.144", "178.16.52.169", "118.25.188.245", "207.189.15.159", "186.169.78.50", "198.12.83.91"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["217.156.65.42", "118.25.103.144", "178.16.52.169", "118.25.188.245", "207.189.15.159", "186.169.78.50", "198.12.83.91"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Quasar RAT

False Positive Guidance

False Positive Scenarios for “ThreatFox: Quasar RAT IOCs”

Scenario: Security Team Manual IOC Hunting
- Context: The SOC team manually imports the latest ThreatFox Quasar IOCs into their SIEM or EDR platform (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon) to perform a proactive hunt. This action triggers the detection rule as if an actual infection occurred because the system is actively querying against those specific hashes and network indicators.
- Suggested Filter/Exclusion: Create a suppression rule that excludes alerts generated by accounts belonging to the Security_Ops or SOC_Admin groups, specifically when the source process is the EDR management console (e.g., C:\Program Files\Microsoft Defender\MsMpEng.exe running under the SYSTEM account) or the SIEM ingestion service.
Scenario: Scheduled Endpoint Protection Updates
- Context: During nightly maintenance windows, enterprise antivirus solutions (such as Symantec Endpoint Protection or Carbon Black) automatically pull threat intelligence feeds from vendors like ThreatFox. The update process involves scanning local files against the new Quasar IOCs, causing legitimate file access and network connections that match the detection logic.
- Suggested Filter/Exclusion: Implement a time-based exclusion for alerts occurring between 02:00 and 05:00 UTC on weekdays, or filter out events where the parent process is identified as the specific AV update service (e.g., Symantec Endpoint Protection Client or Carbon Black Sensor) running under the Local System account.
Scenario: DevOps CI/CD Pipeline Artifact Scanning
- Context: In a continuous integration environment, tools like Jenkins, GitLab Runner, or Azure Dev Services scan build artifacts and container images against known threat intelligence feeds before deployment. When these pipelines download