This hunt detects adversary behavior involving the deployment of Quasar Remote Access Trojan (RAT) by monitoring network and endpoint activity against a curated set of 71 specific Indicators of Compromise (IOCs). Proactively hunting for these IOCs within Azure Sentinel is critical to identify early-stage lateral movement and command-and-control communications, enabling rapid containment before the RAT establishes persistent access to sensitive data.
Malware Family: Quasar RAT Total IOCs: 71 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 188[.]132[.]165[.]148:8080 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 45[.]202[.]1[.]52:4782 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 95[.]214[.]53[.]90:2354 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 85[.]121[.]148[.]77:7675 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 85[.]121[.]148[.]77:1990 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 8[.]138[.]83[.]40:4782 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 130[.]94[.]17[.]91:4782 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 130[.]94[.]17[.]91:4783 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 79[.]141[.]175[.]186:5002 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 45[.]88[.]91[.]40:4782 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 125[.]86[.]30[.]45:4782 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 45[.]43[.]163[.]233:4782 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 194[.]59[.]31[.]91:4530 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 108[.]186[.]112[.]220:4782 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 42[.]193[.]188[.]121:4782 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 194[.]63[.]145[.]99:4782 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 94[.]154[.]32[.]204:4782 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 103[.]216[.]158[.]80:4782 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 104[.]239[.]66[.]189:4782 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 204[.]194[.]54[.]68:4782 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 154[.]23[.]189[.]222:17788 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 13[.]213[.]146[.]45:22148 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 89[.]44[.]80[.]179:6033 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 89[.]44[.]80[.]179:1523 | botnet_cc | 2026-08-19 | 75% |
| ip:port | 222[.]255[.]215[.]8:9123 | botnet_cc | 2026-08-19 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Quasar RAT
let malicious_ips = dynamic(["8.138.83.40", "103.216.158.80", "94.154.32.204", "222.255.215.8", "89.44.80.179", "79.141.175.186", "45.61.177.22", "103.106.188.253", "103.230.15.171", "204.194.54.68", "194.59.31.91", "130.94.17.91", "108.186.112.220", "13.213.146.45", "118.126.97.69", "45.88.91.40", "80.96.113.95", "104.239.66.189", "64.224.17.2", "189.253.224.195", "42.192.37.91", "91.92.243.176", "178.157.82.246", "95.214.53.90", "91.92.47.167", "38.147.191.159", "118.107.23.32", "104.251.180.79", "45.39.241.28", "194.63.145.99", "188.132.165.148", "45.202.1.52", "39.107.60.199", "221.194.78.166", "123.113.8.145", "186.246.53.24", "193.108.114.185", "62.133.61.75", "91.92.240.197", "125.86.30.45", "192.166.82.131", "154.23.189.222", "15.235.172.216", "103.238.74.98", "216.74.123.43", "31.59.118.75", "147.93.153.126", "71.201.61.136", "42.193.188.121", "94.136.184.96"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["8.138.83.40", "103.216.158.80", "94.154.32.204", "222.255.215.8", "89.44.80.179", "79.141.175.186", "45.61.177.22", "103.106.188.253", "103.230.15.171", "204.194.54.68", "194.59.31.91", "130.94.17.91", "108.186.112.220", "13.213.146.45", "118.126.97.69", "45.88.91.40", "80.96.113.95", "104.239.66.189", "64.224.17.2", "189.253.224.195", "42.192.37.91", "91.92.243.176", "178.157.82.246", "95.214.53.90", "91.92.47.167", "38.147.191.159", "118.107.23.32", "104.251.180.79", "45.39.241.28", "194.63.145.99", "188.132.165.148", "45.202.1.52", "39.107.60.199", "221.194.78.166", "123.113.8.145", "186.246.53.24", "193.108.114.185", "62.133.61.75", "91.92.240.197", "125.86.30.45", "192.166.82.131", "154.23.189.222", "15.235.172.216", "103.238.74.98", "216.74.123.43", "31.59.118.75", "147.93.153.126", "71.201.61.136", "42.193.188.121", "94.136.184.96"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: Quasar RAT IOCs detection rule, along with targeted filters and exclusions tailored for an enterprise environment:
Endpoint Protection Vendor Updates
Setup.exe or falconupdater.exe) generates a hash match against one of the 71 IOCs.C:\Program Files\CrowdStrike\ or C:\ProgramData\Microsoft\Windows Defender\ and the executable name matches known vendor binaries (e.g., falconupdater.exe, MsMpEng.exe).Legacy Development Build Artifacts
OU=Dev-Build-Servers). Additionally, filter out events occurring within the context of known CI/CD process names such as java.exe running under the user account svc-jenkins-build or vstsagent.Scheduled Administrative Maintenance Jobs