ThreatFox: CrossRAT IOCs

Hunt Hypothesis

This hunt detects adversary behavior consistent with the CrossRAT remote access trojan by identifying network and host artifacts matching nine specific indicators of compromise within the Azure Sentinel environment. Proactive hunting is critical to rapidly identify early-stage lateral movement or command-and-control communications before the malware establishes persistence, thereby reducing dwell time for this high-severity threat.

IOC Summary

Malware Family: CrossRAT Total IOCs: 9 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`13ed2a77b08df2b52e3420205e763a41`	payload	2026-07-10	95%
sha256_hash	`34da1d049c92313152f28cdf5bad644bff93cc6beca25e139453e20ed7a1a85f`	payload	2026-07-10	95%
sha1_hash	`6d8433dceb879d60c4fbcaf3c1fa66832d8ed101`	payload	2026-07-10	95%
sha1_hash	`679fb2dbfe81808a883729d15cd03b99eda8d1ba`	payload	2026-07-10	95%
md5_hash	`654607f31a256d943a2de9b63b30929c`	payload	2026-07-10	95%
md5_hash	`983cca37c0534eb53f981fb4eb89a7f8`	payload	2026-07-10	95%
sha256_hash	`f35b6cb6af991bfa735e039f6bc0e49c69759c015a2074b87eed8f20e4200135`	payload	2026-07-10	95%
sha256_hash	`c0762bd8b3b098c6d5300256f9e8bc67d45709dc244db37cc55c5e2b0312e907`	payload	2026-07-10	95%
sha1_hash	`b818f746e14dc148f6572c8ab264a62dbe6bc760`	payload	2026-07-10	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - CrossRAT
let malicious_hashes = dynamic(["13ed2a77b08df2b52e3420205e763a41", "34da1d049c92313152f28cdf5bad644bff93cc6beca25e139453e20ed7a1a85f", "6d8433dceb879d60c4fbcaf3c1fa66832d8ed101", "679fb2dbfe81808a883729d15cd03b99eda8d1ba", "654607f31a256d943a2de9b63b30929c", "983cca37c0534eb53f981fb4eb89a7f8", "f35b6cb6af991bfa735e039f6bc0e49c69759c015a2074b87eed8f20e4200135", "c0762bd8b3b098c6d5300256f9e8bc67d45709dc244db37cc55c5e2b0312e907", "b818f746e14dc148f6572c8ab264a62dbe6bc760"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — CrossRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: CrossRAT IOCs detection rule, tailored for a legitimate enterprise environment:

Scheduled Endpoint Protection Scans by CrowdStrike Falcon
- Scenario: The nightly automated scan performed by the CrowdStrike Falcon sensor queries its local definition database or connects to the management console. If the specific IP address of the CrowdStrike update server or the internal DNS resolver used during this handshake matches one of the CrossRAT IOCs (e.g., a shared CDN IP), the rule triggers an alert for every endpoint in the organization simultaneously.
- Filter/Exclusion: Create a suppression rule to exclude traffic originating from the specific CrowdStrike sensor service account (svc-crowdstrike) or filter out destination IPs known to be part of the CrowdStrike global update infrastructure (e.g., *.falcon.crowdstrike.com DNS resolution) when the source process is C:\Program Files\CrowdStrike\FalconSensor.exe.
Microsoft System Center Configuration Manager (SCCM) Software Updates
- Scenario: During a major Windows feature update deployment, SCCM agents on workstations initiate connections to Microsoft Update servers or internal WSUS repositories. If the CrossRAT IOC list includes an IP range shared by Microsoft’s Azure Content Delivery Network (CDN), legitimate download traffic for Office 365 patches or .NET framework updates will be flagged as suspicious cross-platform activity.
- Filter/Exclusion: Exclude connections where the source process is C:\Windows\CCM\CcmExec.exe and the destination IP falls within the Microsoft Azure CDN range (e.g., 13.64.0.0/10). Additionally, whitelist the specific User-Agent strings associated with SCCM update requests if the detection logic parses HTTP headers.
Legacy File Transfer via WinSCP Scheduled Tasks