ThreatFox: Quasar RAT IOCs

Hunt Hypothesis

This hunt hypothesis detects adversaries deploying Quasar RAT to establish remote command execution capabilities and data exfiltration channels through phishing vectors or network compromises. A proactive search in Azure Sentinel is essential to identify early-stage infections via specific IP:port signatures, enabling rapid containment before attackers can solidify persistent control over critical systems.

IOC Summary

Malware Family: Quasar RAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Quasar RAT
let malicious_ips = dynamic(["154.23.189.120", "154.23.189.194"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["154.23.189.120", "154.23.189.194"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Quasar RAT

False Positive Guidance

False Positive Scenarios for “ThreatFox: Quasar RAT IOCs” Detection Rule

• Scenario: Legitimate Remote Management via TeamViewer or AnyDesk

  • Context: Enterprise IT support teams frequently use remote desktop tools like TeamViewer, AnyDesk, or Splashtop to troubleshoot user workstations. These tools often establish persistent connections and execute commands on the host, mimicking the command execution and persistence behaviors of Quasar RAT.
  • Suggested Filter/Exclusion: Create an exclusion rule that filters out traffic originating from known internal IP ranges or specific process hashes for these legitimate tools (e.g., teamviewer.exe, AnyDeskService.exe). Additionally, exclude connections where the destination port matches standard remote desktop ports (5938 for TeamViewer, 7001 for AnyDesk) if they are not flagged as suspicious by the EDR.

• Scenario: Scheduled PowerShell or Bash Maintenance Scripts

  • Context: Automated maintenance jobs running via Windows Task Scheduler or cron often execute complex scripts (e.g., powershell.exe or bash) that query system configurations, exfiltrate logs to a central SIEM, and modify registry keys. These activities trigger the “command execution” and “data exfiltration” logic of the Quasar rule.
  • Suggested Filter/Exclusion: Implement a filter based on process lineage. Exclude alerts where the parent process is svchost.exe (for Windows Task Scheduler) or cron, and the command line arguments contain specific keywords like “Maintenance,” “Backup,” or “ReportGeneration.” Alternatively, whitelist the specific file paths of known maintenance scripts located in standard directories (e.g., C:\ProgramData\Scripts\Maintenance\).

• Scenario: Enterprise Antivirus Cloud Communication

  • Context: Modern Endpoint