ThreatFox: CrossRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior where CrossRAT malware establishes persistence and exfiltrates data by matching network traffic against six specific Indicators of Compromise (IOCs). Proactively hunting for these signatures in Azure Sentinel is critical to rapidly identify early-stage infections before the RAT can fully compromise sensitive workloads or expand laterally across the cloud environment.

IOC Summary

Malware Family: CrossRAT Total IOCs: 6 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`ea709516603279a6513ab58ae93ce220f0f0210e`	payload	2026-07-14	95%
md5_hash	`bb80b31e43893a35fabbdca00c3fd55e`	payload	2026-07-14	95%
sha256_hash	`ae1a58b73c14de3d0d4af02ac0c136a4e804ed1a911de386fa40208672611309`	payload	2026-07-14	95%
sha256_hash	`78b21599a83dbfad39c17202d37dd2b6d552c9679755bc199a9826f3dd0e40db`	payload	2026-07-14	95%
sha1_hash	`40ebd40d5c84d2facd38a01ac800890315bf0bff`	payload	2026-07-14	95%
md5_hash	`055b997d5589c2c01799c98752cdde44`	payload	2026-07-14	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - CrossRAT
let malicious_hashes = dynamic(["ea709516603279a6513ab58ae93ce220f0f0210e", "bb80b31e43893a35fabbdca00c3fd55e", "ae1a58b73c14de3d0d4af02ac0c136a4e804ed1a911de386fa40208672611309", "78b21599a83dbfad39c17202d37dd2b6d552c9679755bc199a9826f3dd0e40db", "40ebd40d5c84d2facd38a01ac800890315bf0bff", "055b997d5589c2c01799c98752cdde44"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — CrossRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: CrossRAT IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Endpoint Security Scanning of Quarantine Archives
- Scenario: The organization’s EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs scheduled deep scans on the C:\Quarantine folder. This directory contains archived samples from previous threat hunts, including historical CrossRAT binaries that were previously analyzed and deemed safe but retained for forensic reference. The EDR agent generates network or file access events matching the 6 IOCs during this routine scan.
- Filter/Exclusion: Exclude file paths containing C:\Quarantine, C:\Temp\Archive, or specific EDR service accounts (e.g., NT SERVICE\CrowdStrikeService) from triggering alerts on these specific IOCs, provided the files have a “Last Modified” timestamp older than 30 days.
Software Supply Chain Updates via Patch Management
- Scenario: The IT operations team uses Microsoft SCCM (Configuration Manager) or Ivanti Endpoint Manager to deploy a critical update for a third-party enterprise application (e.g., Adobe Acrobat Pro DC or Zoom Workplace). The installer package temporarily extracts the CrossRAT-related DLLs and executables into the %TEMP% directory of the SYSTEM account before installation. This extraction process triggers file creation events matching the detection logic.
- Filter/Exclusion: Create an exclusion rule for processes initiated by known patch management services (e.g., ccmexec.exe, IvantiAgentService) operating within standard temporary directories (%TEMP%, %LOCALAPPDATA%\Temp), specifically filtering out events where the parent process is a trusted deployment agent.