ThreatFox: CrossRAT IOCs

Hunt Hypothesis

This hunt detects adversary behavior where malicious actors deploy the CrossRAT remote access trojan to establish persistence and exfiltrate sensitive data through known indicators of compromise. The SOC team should proactively search for these specific IOCs within Azure Sentinel to identify early-stage infections before they escalate into full-blown lateral movement or data breach incidents.

IOC Summary

Malware Family: CrossRAT Total IOCs: 6 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`ec9416ccf51a95a73d9cbd6a54394212`	payload	2026-07-13	95%
md5_hash	`bc8c370a9bf67ef75534753fb0d601df`	payload	2026-07-13	95%
sha256_hash	`52bd61ba2153572260fc9b8f7eac34b613272c428e715fe6b3505f96e4eacf5d`	payload	2026-07-13	95%
sha1_hash	`f70b70582d3935ae4b225e7899f8e19c7983f0b7`	payload	2026-07-13	95%
sha256_hash	`c4fc9162227b35c631fbe623ee30fa7f660ed015915ed66c76942b1583ac3f77`	payload	2026-07-13	95%
sha1_hash	`e315a7611e35a532955b1c4ddcf8a6c50771cf8b`	payload	2026-07-13	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - CrossRAT
let malicious_hashes = dynamic(["ec9416ccf51a95a73d9cbd6a54394212", "bc8c370a9bf67ef75534753fb0d601df", "52bd61ba2153572260fc9b8f7eac34b613272c428e715fe6b3505f96e4eacf5d", "f70b70582d3935ae4b225e7899f8e19c7983f0b7", "c4fc9162227b35c631fbe623ee30fa7f660ed015915ed66c76942b1583ac3f77", "e315a7611e35a532955b1c4ddcf8a6c50771cf8b"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — CrossRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: CrossRAT IOCs detection rule, tailored for an enterprise environment where legitimate administrative and maintenance activities mimic RAT behavior:

Endpoint Protection Policy Updates via Microsoft Intune/SCCM
- Scenario: During scheduled maintenance windows, the Endpoint Detection and Response (EDR) agent pushes a policy update or definition database refresh. This process often involves downloading large configuration files from internal repositories that may share hash signatures or network destinations with known CrossRAT command-and-control (C2) infrastructure, particularly if the organization uses public cloud storage for distribution points.
- Filter/Exclusion: Create an exclusion rule to ignore alerts originating from the specific service accounts used by Microsoft Intune (MSIntuneAgent) or SCCM (SMS_EXECUTIVE), specifically when the process path matches C:\Program Files\Microsoft Intune Management Extension\. Additionally, exclude traffic destined for internal IP ranges designated as “Software Distribution Points.”
Automated Backup and Archiving via Veeam or Commvault
- Scenario: Enterprise backup agents (e.g., Veeam Agent or Commvault Simpana) execute scheduled jobs to compress and encrypt data before uploading it to a centralized repository. The encryption module may generate network traffic patterns and file hashes that overlap with the IOCs associated with CrossRAT’s data exfiltration modules, especially when connecting to external S3-compatible storage buckets for offsite redundancy.
- Filter/Exclusion: Filter out events where the parent process is VeeamAgent.exe or SimpanaService.exe. Implement a whitelist for specific destination IP addresses belonging to the organization’s approved cloud backup providers (e.g., AWS S3 endpoints used exclusively by the backup team) and exclude file operations occurring during the defined “Backup Maintenance Window” (e.g., 02:00–