Detects CrossRAT known hash

Hunt Hypothesis

This rule identifies the execution of the CrossRAT remote access tool by matching its specific file hash against ingested telemetry within Azure Sentinel. Proactively hunting for this signature is essential to distinguish legitimate administrative usage from potential unauthorized remote sessions that could serve as a foothold for lateral movement or data exfiltration.

YARA Rule

rule CrossRAT: RAT
{
    meta:
        description = "Detects CrossRAT known hash"
        author = "Simon Sigre (simon.sigre@gmail.com)"
        date = "26/01/2018"
        ref = "https://simonsigre.com"
        ref= "https://objective-see.com/blog/blog_0x28.html"
    strings:
        $magic = { 50 4b 03 04 ( 14 | 0a ) 00 }
        $string_1 = "META-INF/"
        $string_2 = ".class" nocase

    condition:
        filesize < 400KB and
        $magic at 0 and 1 of ($string_*) and
        hash.md5(0, filesize) == "85b794e080d83a91e904b97769e1e770"
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects CrossRAT known hash rule, tailored for a legitimate enterprise environment:

• Endpoint Detection and Response (EDR) Agent Self-Updates

  • Scenario: The organization’s primary EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs an automated background update of its core sensor component. Since the CrossRAT hash is often associated with legitimate telemetry collectors, the EDR agent’s own installation or signature database update may match this known good hash while writing to protected system directories.
  • Filter/Exclusion: Create a rule exclusion based on the specific process image path of the EDR service (e.g., C:\Program Files\CrowdStrike\fsagent.exe) and restrict the detection scope to exclude events where the parent process is the EDR’s own updater service.

• Scheduled Enterprise Patch Management Deployments

  • Scenario: During a nightly maintenance window, the IT team utilizes a patch management tool (e.g., Ivanti or SCCM) to deploy critical security updates across the domain. The deployment agent installs a specific utility component that matches the CrossRAT known hash as part of the standard OS hardening package, triggering the rule on hundreds of workstations simultaneously at 02:00 AM.
  • Filter/Exclusion: Implement a time-based filter to suppress alerts for this specific hash between 01:30 and 04:30 UTC, or exclude events where the initiating process is the patch management agent (e.g., ccmexec.exe or IvAgent.exe) running under the SYSTEM account.

• Automated Compliance and Configuration Auditing

  • Scenario: A scheduled compliance job runs using a tool like Qualys or Tenable Nessus to scan internal assets for configuration drift. The scanner’s