This hunt identifies potential Quasar RAT infections by correlating network traffic or host activity against known IOCs, detecting the remote access tool often used for initial access and lateral movement. Proactively hunting for these indicators in Azure Sentinel is critical to uncover dormant or stealthy compromises that may have bypassed traditional perimeter defenses, enabling the SOC to isolate affected assets before the adversary establishes a persistent foothold.
Malware Family: Quasar RAT Total IOCs: 10 IOC Types: md5_hash, ip:port, sha1_hash, sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 38[.]54[.]94[.]117:4783 | botnet_cc | 2026-09-06 | 75% |
| ip:port | 45[.]225[.]135[.]87:80 | botnet_cc | 2026-09-06 | 75% |
| ip:port | 103[.]106[.]67[.]96:1020 | botnet_cc | 2026-09-06 | 75% |
| ip:port | 177[.]9[.]99[.]79:1005 | botnet_cc | 2026-09-06 | 75% |
| ip:port | 103[.]89[.]13[.]21:4782 | botnet_cc | 2026-09-06 | 75% |
| ip:port | 31[.]57[.]38[.]167:4782 | botnet_cc | 2026-09-06 | 75% |
| ip:port | 169[.]58[.]131[.]93:4783 | botnet_cc | 2026-09-06 | 75% |
| sha256_hash | 1f5214dad42cbad505f559ab2bc332139d6a5d6b9e080d35ec5576e7141dddd1 | payload | 2026-09-06 | 95% |
| sha1_hash | af94a7e03eb3d3def52a88de34085d747cdfc2b6 | payload | 2026-09-06 | 95% |
| md5_hash | 54c426085dec3ece1925a0eecc5e6433 | payload | 2026-09-06 | 95% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Quasar RAT
let malicious_ips = dynamic(["45.225.135.87", "103.106.67.96", "169.58.131.93", "177.9.99.79", "31.57.38.167", "103.89.13.21", "38.54.94.117"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.225.135.87", "103.106.67.96", "169.58.131.93", "177.9.99.79", "31.57.38.167", "103.89.13.21", "38.54.94.117"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - Quasar RAT
let malicious_hashes = dynamic(["1f5214dad42cbad505f559ab2bc332139d6a5d6b9e080d35ec5576e7141dddd1", "af94a7e03eb3d3def52a88de34085d747cdfc2b6", "54c426085dec3ece1925a0eecc5e6433"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceFileEvents | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
powershell.exe or pwsh.exe and the parent process is a known CI/CD agent (e.g., jenkins-agent.exe, azure-devops-agent.exe) or where the file path resides in standard build directories like C:\ProgramData\Jenkins\workspace\ or C:\AzureDevOps\.\\fileserver\tools\) to a local user’s Downloads or Temp folder, which matches an IOC file path or hash.
\Temp\, \Downloads\, or \AppData\Local\Temp\ and the parent process is explorer.exe or cmd.exe, provided the user account is in the Domain Admins or IT Support security group.volatility, memdump.exe) that temporarily creates a file with a name or hash matching a Quasar RAT IOC during a scheduled vulnerability scan.
yara.exe, volatility.exe, nmap.exe) or where the event occurs within a defined maintenance window (e.g., Sundays 02:00-04: