This hunt targets known CrossRAT indicators of compromise to identify hosts that may be compromised by this remote access trojan, which is frequently used for initial access and lateral movement. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect persistent threats before they can establish a foothold, exfiltrate data, or deploy additional payloads within the environment.
Malware Family: CrossRAT Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| md5_hash | f4a21c6c2dbc446fadce7744a112cb14 | payload | 2026-09-13 | 95% |
| sha256_hash | 73297baf09544ba19037911c2a5352069622ebdbccae2ae15d7150c718dd81f4 | payload | 2026-09-13 | 95% |
| sha1_hash | e9f57b057380b8da867c57a26550ea509e5cb3e8 | payload | 2026-09-13 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - CrossRAT
let malicious_hashes = dynamic(["f4a21c6c2dbc446fadce7744a112cb14", "73297baf09544ba19037911c2a5352069622ebdbccae2ae15d7150c718dd81f4", "e9f57b057380b8da867c57a26550ea509e5cb3e8"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Scenario: A legacy Java-based internal application (e.g., a custom inventory management system) uses a specific version of the com.sun.net.httpserver or a similar HTTP client library that shares a unique string constant or class name with one of the CrossRAT IOCs. This can happen if the IOC is a generic string like a specific URL path or a common Java package name used in older frameworks.
java.exe or javaw.exe and the command line contains the specific internal application name (e.g., inventory-app.jar). Alternatively, exclude if the file path resides in the known internal application directory (e.g., C:\Apps\Inventory\bin\).Scenario: An IT admin uses a generic network testing tool like curl or wget via a scheduled task or PowerShell script to ping an internal health-check endpoint. If the CrossRAT IOC includes a specific IP address or domain (e.g., 192.168.1.100 or crossrat.io) that coincidentally matches an internal staging server or a public CDN used for static asset delivery, the rule may trigger.
curl.exe, wget.exe, or powershell.exe and the destination IP is within the internal RFC1918 range (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or matches a known internal DNS zone (e.g., *.internal.corp).Scenario: A developer or QA engineer runs a local web server (e.g., python -m http.server or nginx) for testing a new frontend component.