ThreatFox: CrossRAT IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving specific Indicators of Compromise (IOCs) linked to the CrossRAT remote access trojan, which is frequently used by threat actors for command and control and lateral movement within networks. SOC teams should proactively hunt for these IOCs in Azure Sentinel because early identification of CrossRAT presence allows for immediate containment before attackers can establish persistent footholds or exfiltrate sensitive data through compromised endpoints.

IOC Summary

Malware Family: CrossRAT Total IOCs: 6 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`e5bccb979fef3945c64622c6ad4461947eca123465f2989d9f4af879fd467890`	payload	2026-07-25	95%
sha1_hash	`af381a40b1babd7f65f118608a958fc1aa48f115`	payload	2026-07-25	95%
md5_hash	`cc7e9ae7f054d90355af2dd379625ec3`	payload	2026-07-25	95%
md5_hash	`c29ddb54bb464846ba7e2de1d3eff471`	payload	2026-07-25	95%
sha256_hash	`748c32e3718319e569d7a71eab5ace7589ed012764902b55475faab82a63c89b`	payload	2026-07-25	95%
sha1_hash	`49d293bee3fe99fbc0cf857347d9e5259dc41b94`	payload	2026-07-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - CrossRAT
let malicious_hashes = dynamic(["e5bccb979fef3945c64622c6ad4461947eca123465f2989d9f4af879fd467890", "af381a40b1babd7f65f118608a958fc1aa48f115", "cc7e9ae7f054d90355af2dd379625ec3", "c29ddb54bb464846ba7e2de1d3eff471", "748c32e3718319e569d7a71eab5ace7589ed012764902b55475faab82a63c89b", "49d293bee3fe99fbc0cf857347d9e5259dc41b94"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — CrossRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: CrossRAT IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

Scenario: Scheduled Vulnerability Scanning by Qualys or Tenable
- Context: Enterprise vulnerability scanners (e.g., Qualys Cloud Agent, Tenable Nessus) frequently perform deep network sweeps that involve connecting to external update servers or downloading large signature databases. These activities often match the specific file hashes or network destinations associated with CrossRAT IOCs due to shared infrastructure or common software dependencies.
- Filter/Exclusion: Create a rule exclusion based on the Process Name (e.g., qualyspc.exe, tenable_agent.exe) and restrict the alert scope to exclude traffic originating from the “Vulnerability Management” security group in Active Directory.
Scenario: Automated Patch Deployment via Microsoft Endpoint Configuration Manager (MECM/SCCM)
- Context: During scheduled maintenance windows, SCCM agents download patches and configuration packages from distribution points that may utilize the same external endpoints or file signatures flagged by CrossRAT. The deployment engine often spawns child processes that mimic the behavior of legitimate RATs when extracting payloads.
- Filter/Exclusion: Exclude alerts where the Parent Process is ccmsetup.exe or wuauserv.exe and the execution time falls within the defined “Patch Tuesday” maintenance window (e.g., 02:00–04:00 UTC).
Scenario: Endpoint Detection and Response (EDR) Telemetry Uploads
- Context: EDR solutions like CrowdStrike Falcon or Microsoft Defender for Endpoint periodically upload telemetry data, behavioral logs, and threat intelligence feeds to their cloud backends. These uploads can trigger network connections that overlap with the IOCs defined in the Cross