ThreatFox: CraxsRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving CraxsRAT remote access trojans by actively searching for specific indicators of compromise (IOCs) known to facilitate command-and-control communications and lateral movement. Proactively hunting for these signatures in Azure Sentinel is critical because early detection of this RAT prevents attackers from establishing persistent footholds that could lead to sensitive data exfiltration before traditional alerting triggers.

IOC Summary

Malware Family: CraxsRAT Total IOCs: 3 IOC Types: ip:port, sha256_hash

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - CraxsRAT
let malicious_ips = dynamic(["91.92.33.183"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["91.92.33.183"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - CraxsRAT
let malicious_hashes = dynamic(["5f94e59c132a7ed0e35b60146d973a728ab9f390c8291f9547cee26c56427738", "fc99609172910a8fad9522b374f8bae21e5805abdf052a49029edb53620a8e8c"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — CraxsRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: CraxsRAT IOCs detection rule, tailored for an enterprise environment:

• Software Deployment via Endpoint Protection Scanning

  • Scenario: During a scheduled maintenance window, the IT team deploys a new version of Microsoft Defender for Endpoint or CrowdStrike Falcon. The deployment package includes a legitimate update that contains a shared cryptographic hash or file path matching one of the CraxsRAT IOCs (often due to a common library like msvcp140.dll or a specific installer component).
  • Filter/Exclusion: Create an exclusion for the specific Service Account used by the deployment tool (e.g., svc-software-deploy) and filter alerts where the process parent is the known deployment agent (e.g., SCCMClient.exe or FalconSensor.exe).

• Administrative Script Execution in Development Environments

  • Scenario: A DevOps engineer runs a PowerShell script on a build server to automate the configuration of a CI/CD pipeline. The script downloads and executes a legitimate third-party utility (e.g., 7-Zip, Git for Windows, or a specific Java Runtime Environment) that happens to share an IOC signature with CraxsRAT, particularly in the C:\Program Files\ directory structure.
  • Filter/Exclusion: Exclude alerts originating from known Build Server Hostnames (e.g., *BUILD-SRV-01) and filter by process path containing standard software vendor directories (e.g., \Microsoft\, \Git\, \7-Zip\).

• Scheduled Backup Agent Activity

  • Scenario: The enterprise backup solution, such as Veeam Backup & Replication or Commvault, initiates a scheduled job to back