ThreatFox: CrossRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior where malicious actors deploy the CrossRAT remote access trojan to establish persistent command-and-control channels using three specific indicators of compromise. Proactively hunting for these IOCs in Azure Sentinel is critical because early detection of CrossRAT activity allows the SOC team to isolate compromised endpoints before attackers can exfiltrate sensitive data or pivot laterally across the network.

IOC Summary

Malware Family: CrossRAT Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`24b670caf5090f91fff6ad82ffcfe21b61f1e14c`	payload	2026-07-01	95%
md5_hash	`37daa89551604908ec63096ec5a87504`	payload	2026-07-01	95%
sha256_hash	`f682942cb2b55e88b3dc13b228c35765ad624434cf472490078a29566c7bfa03`	payload	2026-07-01	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - CrossRAT
let malicious_hashes = dynamic(["24b670caf5090f91fff6ad82ffcfe21b61f1e14c", "37daa89551604908ec63096ec5a87504", "f682942cb2b55e88b3dc13b228c35765ad624434cf472490078a29566c7bfa03"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — CrossRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: CrossRAT IOCs detection rule, tailored for an enterprise environment:

Software Deployment via SCCM/Intune
- Scenario: The IT Operations team deploys a new version of the “CrossRAT” remote management agent (or a legitimate tool sharing similar network signatures) to 500+ endpoints using Microsoft Endpoint Configuration Manager (SCCM). This mass deployment triggers the hunt package as the installer communicates with known CrossRAT update servers and command-and-control (C2) endpoints.
- Filter/Exclusion: Exclude traffic originating from the specific SCCM Management Point server IP range or filter out events where the process name is ccmexec.exe or Microsoft.Windows.CloudExperienceHost communicating with the identified IOCs during scheduled maintenance windows (e.g., 02:00–04:00 UTC).
Vendor-Managed Remote Support Sessions
- Scenario: A third-party Managed Service Provider (MSP) utilizes a remote support tool that shares network fingerprints or hash signatures with the CrossRAT malware family. When an engineer initiates an emergency session to troubleshoot a critical SQL Server instance, the tool establishes connections to its own C2 infrastructure, which overlaps with the ThreatFox IOCs.
- Filter/Exclusion: Create an exclusion rule for traffic generated by specific vendor support tools (e.g., TeamViewer.exe, AnyDesk.exe, or LogMeIn.exe) when initiated from known Vendor IP subnets. Additionally, exclude events where the user context is a dedicated “Remote Support” service account rather than standard interactive users.
Automated Patch Management and Health Checks
- Scenario: An enterprise-wide scheduled job runs nightly to perform health checks on remote management agents. This job involves the Task Scheduler launching a