This hunt targets adversary behavior involving the deployment of Quasar Remote Access Trojan (RAT) by detecting specific Indicators of Compromise across network and endpoint telemetry. Proactively hunting for these IOCs in Azure Sentinel is critical to identify early-stage lateral movement and data exfiltration attempts before they escalate into full-scale compromises within the cloud environment.
Malware Family: Quasar RAT Total IOCs: 3 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 37[.]72[.]168[.]240:80 | botnet_cc | 2026-07-10 | 100% |
| ip:port | 194[.]59[.]31[.]127:5000 | botnet_cc | 2026-07-10 | 100% |
| ip:port | 20[.]217[.]83[.]155:4445 | botnet_cc | 2026-07-10 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Quasar RAT
let malicious_ips = dynamic(["37.72.168.240", "20.217.83.155", "194.59.31.127"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["37.72.168.240", "20.217.83.155", "194.59.31.127"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios for the ThreatFox: Quasar RAT IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:
Security Tool Internal Scans: Security Information and Event Management (SIEM) agents or Endpoint Detection and Response (EDR) tools like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne often perform internal telemetry collection that mimics RAT behavior. These agents may spawn processes communicating with their management consoles using the specific IOCs flagged by Quasar.
C:\Program Files\CrowdStrike\fsagent.exe, MsMpEng.exe) and restrict alerts to non-administrator service accounts running these agents.Scheduled Software Deployment Jobs: Enterprise IT teams frequently use deployment tools like Microsoft SCCM (Configuration Manager), Ivanti, or Ansible to push updates or configuration scripts during maintenance windows. These scheduled jobs often execute PowerShell scripts or batch files that establish connections to internal repositories, inadvertently matching the network signature of Quasar RAT IOCs.
TaskScheduler tasks named “Monthly_Patch_Deploy” or “Config_Sync”) and limit the rule scope to exclude the internal IP ranges of the deployment servers.Third-Party Remote Support Sessions: Legitimate IT support operations utilizing tools such as TeamViewer, AnyDesk, Splashtop, or Microsoft Quick Assist often initiate remote sessions that involve process injection and command execution similar to RAT functionality. When a helpdesk technician connects to a user’s workstation, the tool may trigger the specific IOCs associated with Quasar.