ThreatFox: CrossRAT IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving the specific indicators of compromise (IOCs) linked to the CrossRAT remote access trojan, which is frequently used for credential theft and lateral movement within enterprise networks. SOC teams should proactively hunt for these IOCs in their Azure Sentinel environment to rapidly detect early-stage infections and mitigate potential data exfiltration before the threat establishes a persistent foothold.

IOC Summary

Malware Family: CrossRAT Total IOCs: 3 IOC Types: md5_hash, sha1_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`bbdbbbaa2596aa7a8a85fa4d4090c4a0387d7d74`	payload	2026-08-08	95%
md5_hash	`2d4fe10deb30092875ad0e5327904cd9`	payload	2026-08-08	95%
sha256_hash	`07b1a32c53c1efab24f54151b1158bad7404374f0dfdee558e7ad80ad278575a`	payload	2026-08-08	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - CrossRAT
let malicious_hashes = dynamic(["bbdbbbaa2596aa7a8a85fa4d4090c4a0387d7d74", "2d4fe10deb30092875ad0e5327904cd9", "07b1a32c53c1efab24f54151b1158bad7404374f0dfdee558e7ad80ad278575a"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — CrossRAT

False Positive Guidance

Here are the documented false positive scenarios and corresponding filters for the ThreatFox: CrossRAT IOCs detection rule:

Scenario 1: Endpoint Protection Scanning of Quarantine Archives
- Context: The enterprise’s primary endpoint protection suite (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) performs a scheduled daily scan of the “Quarantine” folder. This process often extracts and analyzes archived threat samples that include CrossRAT signatures, triggering network connections to known IOCs as part of the telemetry upload.
- Filter/Exclusion: Exclude traffic originating from the specific service accounts or hostnames associated with the EDR agent (e.g., MSDEFENDER_SERVICE or CrowdStrike_FalconAgent) when connecting to the detection’s defined IOCs during scheduled maintenance windows (e.g., 02:00–04:00 local time).
Scenario 2: Automated Software Deployment via Configuration Management
- Context: The IT Operations team utilizes a configuration management tool like Ansible or SCCM to deploy a new version of the “CrossRAT” security module to all workstations. During the deployment phase, the installer communicates with the vendor’s update servers and validation endpoints, which match the rule’s IOCs.
- Filter/Exclusion: Create an exclusion for processes running under the SCCM or Ansible-Runner service accounts that are executing known installation binaries (e.g., ccmsetup.exe, ansible-playbook) communicating with the specific vendor IP ranges identified in the IOC set.
Scenario 3: Third-Party SIEM Log Forwarding and Enrichment
- Context: The organization’s central log management system (e.g., Splunk or Elastic Stack) runs a scheduled job to fetch threat intelligence feeds from ThreatFox for enrichment purposes.