ThreatFox: Quasar RAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of Quasar Remote Access Trojans (RAT) by detecting specific Indicators of Compromise (IOCs) known to facilitate remote command execution and data exfiltration. Proactively hunting for these signatures in Azure Sentinel is critical because early identification of this high-severity threat allows SOC teams to isolate compromised endpoints before attackers establish persistent footholds within the cloud environment.

IOC Summary

Malware Family: Quasar RAT Total IOCs: 2 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Quasar RAT
let malicious_ips = dynamic(["188.174.38.243"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["188.174.38.243"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Quasar RAT
let malicious_domains = dynamic(["indiagov.duckdns.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Quasar RAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Quasar RAT IOCs detection rule, tailored for a legitimate enterprise environment:

• Antivirus Definition Updates via WSUS/SCCM

  • Scenario: The organization uses Microsoft Endpoint Configuration Manager (MECM) or WSUS to push security updates. During the nightly maintenance window, the update agent downloads and installs new definition signatures from a vendor (e.g., CrowdStrike or SentinelOne) that happens to share a specific hash or file path with a Quasar RAT IOC.
  • Filter/Exclusion: Create an exclusion for processes originating from C:\Windows\CCM\ (SCCM client) and C:\Program Files\Microsoft Update Agent\, specifically targeting the executable names ccmexec.exe and wuauclt.exe. Additionally, whitelist the specific SHA256 hash of the legitimate vendor’s update package if it matches the IOC.

• Scheduled PowerShell Auditing Scripts

  • Scenario: A System Administrator has a scheduled task running via Task Scheduler that executes a custom PowerShell script (Audit-SystemHealth.ps1) to generate compliance reports. This script invokes powershell.exe with arguments pointing to a remote repository or internal artifact server, triggering the network connection IOC associated with Quasar RAT’s command-and-control behavior.
  • Filter/Exclusion: Exclude traffic and process execution where the parent process is TaskSchedulerService (or svchost.exe running under the “System” account) and the target script path resides in a known administrative folder, such as C:\Scripts\Compliance\. Whitelist the specific internal IP address of the artifact repository if it matches the IOC’s destination.

• Third-Party Remote Support Sessions

  • Scenario: The IT Helpdesk utilizes TeamViewer or **