ThreatFox: Quasar RAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the Quasar Remote Access Trojan (RAT) by identifying specific Indicators of Compromise that signal potential command-and-control communication or post-compromise reconnaissance within the environment. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly identify and contain stealthy RAT deployments that could facilitate long-term data exfiltration or lateral movement before they are detected by standard alerting mechanisms.

IOC Summary

Malware Family: Quasar RAT Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`6daf41bd96b45d41c4a6c149efda326e5baf663e`	payload	2026-08-30	95%
md5_hash	`f6db29a1c53467f9d613666064785e98`	payload	2026-08-30	95%
sha256_hash	`95dc20449c307be8bad1541a3fbf53ee6c9a107f9add5811f744ee33e344b63d`	payload	2026-08-30	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Quasar RAT
let malicious_hashes = dynamic(["6daf41bd96b45d41c4a6c149efda326e5baf663e", "f6db29a1c53467f9d613666064785e98", "95dc20449c307be8bad1541a3fbf53ee6c9a107f9add5811f744ee33e344b63d"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Quasar RAT

False Positive Guidance

Here are 5 specific false positive scenarios and their corresponding filters/exclusions for the ThreatFox: Quasar RAT IOCs detection rule:

Scenario: Legitimate EDR Agent Updates or Policy Synchronization.
- Context: Enterprise Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne frequently communicate with their cloud management consoles using specific IOCs that overlap with Quasar RAT signatures during scheduled policy pushes or agent health checks.
- Filter/Exclusion: Exclude network traffic and process execution events where the parent process is FalconSensor.exe, MsMpEng.exe, or SentinelOneAgent.exe connecting to known vendor cloud endpoints (e.g., *.falcon.crowdstrike.com or *.defender.microsoft.com).
Scenario: Scheduled Administrative Backup Jobs.
- Context: Automated backup solutions such as Veeam Backup & Replication or Commvault often utilize specific hashing algorithms and network ports that match the IOCs associated with Quasar RAT’s command-and-control (C2) mechanisms when performing nightly data transfers to on-premise repositories.
- Filter/Exclusion: Create a rule exclusion for processes running under the SYSTEM or Network Service account with executable paths containing \Veeam\ or \Commvault\, specifically during defined maintenance windows (e.g., 02:00–04:00 local time).
Scenario: Internal Software Deployment via SCCM/Intune.
- Context: During mass software deployments, the Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune client (ccmexec.exe / IntuneManagementExtension) may generate network connections and file artifacts that mimic the IOCs of Quasar RAT as it pushes