Quasar Linux RAT (QLNX): Detecting DevOps Credential Harvesting and Supply Chain Threats

---
title: Potential QLNX RAT - Suspicious Access to SSH Directory
id: 8a2b1c9d-0e3f-4a5b-8c6d-1e2f3a4b5c6d
status: experimental
description: Detects processes reading SSH private keys or config files that are not the SSH client or server itself. QLNX harvests these keys for lateral movement.
references:
  - https://thehackernews.com/2026/05/quasar-linux-rat-steals-developer.html
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  product: linux
  category: file_access
detection:
  selection:
    path|contains:
      - '/.ssh/id_rsa'
      - '/.ssh/id_ed25519'
      - '/.ssh/config'
      - '/.ssh/known_hosts'
  filter_main:
    process|contains:
      - 'ssh'
      - 'sshd'
      - 'git' # Git often reads ssh config for auth
      - 'ansible'
  condition: selection and not filter_main
falsepositives:
  - Legitimate backup software scanning home directories
  - Security scanners
level: high
---
title: Potential QLNX RAT - Systemd Persistence from Writable Path
id: 9b3c2d0e-1f4a-5b6c-9d7e-2f3a4b5c6d7e
status: experimental
description: Detects creation of systemd unit files that reference executables in temporary or user-writable directories (/tmp, /var/tmp, /dev/shm), a common persistence mechanism for Linux RATs.
references:
  - https://thehackernews.com/2026/05/quasar-linux-rat-steals-developer.html
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.persistence
  - attack.t1543.002
logsource:
  product: linux
  category: file_creation
detection:
  selection:
    path|contains: '/etc/systemd/system/'
    path|endswith: '.service'
  filter_content:
    content|contains:
      - 'ExecStart=/tmp'
      - 'ExecStart=/var/tmp'
      - 'ExecStart=/dev/shm'
  condition: selection and filter_content
falsepositives:
  - Legitimate developer testing of systemd services
level: critical
---
title: Potential QLNX RAT - Suspicious Network Tunneling Tool Execution
id: 0c4d3e1f-2a5b-6c7d-0e8f-3a4b5c6d7e8f
status: experimental
description: Detects execution of common network proxying/tunneling utilities often spawned by RATs for C2 or lateral movement, initiated from non-standard paths.
references:
  - https://thehackernews.com/2026/05/quasar-linux-rat-steals-developer.html
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.command_and_control
  - attack.t1572
logsource:
  product: linux
  category: process_creation
detection:
  selection_tools:
    process|contains:
      - 'socat'
      - 'nc'
      - 'nmap'
      - 'proxychains'
  selection_suspicious_path:
    exec|contains:
      - '/tmp'
      - '/var/tmp'
      - '/dev/shm'
      - '.hidden'
  condition: selection_tools and selection_suspicious_path
falsepositives:
  - System administration tasks from temporary directories
level: medium

// Hunt for processes reading sensitive credential files
// Excludes legitimate SSH and Git operations
DeviceProcessEvents
| where Timestamp > ago(7d)
| whereFolderPath has @"/.ssh/" or FolderPath has @"/.aws/" or FolderPath has @"/.config/gcloud/"
| where not(ProcessName has "ssh" 
         or ProcessName has "git" 
         or ProcessName has "aws" 
         or ProcessName has "gcloud" 
         or ProcessName has "scp")
| project Timestamp, DeviceName, InitiatingProcessAccountName, ProcessName, ProcessCommandLine, FolderPath
| extend FilePath = FolderPath
| order by Timestamp desc

-- Hunt for QLNX Indicators: Suspicious processes accessing sensitive directories
LET sensitive_dirs = glob(globs='/root/.ssh/*', '/home/*/.ssh/id_rsa', '/home/*/.ssh/config')

SELECT 
  Pid, 
  Name, 
  CommandLine, 
  Exe, 
  Username, 
  Cwd
FROM pslist()
WHERE 
  -- Check if process is running from a suspicious location (common malware tactic)
  Exe =~ '^/tmp/' 
  OR Exe =~ '^/var/tmp/' 
  OR Exe =~ '^/dev/shm/'
  OR Name IN ('socat', 'nc', 'nmap') AND Exe NOT IN ('/usr/bin/nc', '/usr/bin/socat', '/usr/bin/nmap')

#!/bin/bash
# Security Arsenal Incident Response - QLNX RAT Response Script
# Usage: sudo ./qlnx_response.sh

echo "[*] Starting QLNX RAT Investigation and Remediation..."

# 1. Check for suspicious systemd services
echo "[*] Checking for suspicious systemd services..."
SYSTEMD_UNITS=$(grep -r "ExecStart=/" /etc/systemd/system/ /lib/systemd/system/ /run/systemd/system/ 2>/dev/null | grep -E "/tmp|/var/tmp|/dev/shm|\.hidden")
if [ -n "$SYSTEMD_UNITS" ]; then
    echo "[!] Suspicious systemd units found:"
    echo "$SYSTEMD_UNITS"
    # Note: Manual verification required before deletion to avoid system instability
else
    echo "[+] No suspicious systemd units detected."
fi

# 2. Identify processes running from /tmp, /var/tmp, or /dev/shm (High Risk)
echo "[*] Scanning for processes running from temporary directories..."
SUSP_PROCS=$(ps aux | awk '{print $11}' | grep -E "^/tmp/|^/var/tmp/|^/dev/shm/")
if [ -n "$SUSP_PROCS" ]; then
    echo "[!] ALERT: Processes found running from temp directories (Potential QLNX):"
    ps aux | grep -E "^/tmp/|^/var/tmp/|^/dev/shm/" | grep -v grep
    echo "[!] Recommend manual investigation and killing of these PIDs."
else
    echo "[+] No processes running from temp directories."
fi

# 3. Check for recent modifications to SSH keys (Indicates access/harvesting)
echo "[*] Checking for recently modified SSH keys (last 24 hours)..."
find /home/*/.ssh/ /root/.ssh/ -type f -mtime -1 -exec ls -la {} \; 2>/dev/null

# 4. Network Checks (Established connections to non-standard ports)
echo "[*] Listing established connections to non-standard high ports..."
ss -tuln | grep ESTAB | awk '{print $5}' | cut -d':' -f2 | sort -u | awk '$1 > 1024'

echo "[*] Script complete. Review output above for Indicators of Compromise."