ThreatFox: CrossRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving six specific indicators of compromise (IOCs) linked to the CrossRAT remote access trojan, which is known for establishing persistent backdoors and exfiltrating sensitive data. A SOC team should proactively search for these IOCs in Azure Sentinel to identify early-stage infections before attackers can leverage the trojan’s capabilities to move laterally or escalate privileges within the environment.

IOC Summary

Malware Family: CrossRAT Total IOCs: 6 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`842c0ec2c16fd14a656b3caa6b0d93fc`	payload	2026-08-07	95%
sha256_hash	`8a494cf5613a27de7739d417506a93aa98c51453230f61de36d18d53e5456d97`	payload	2026-08-07	95%
sha1_hash	`0617b24e963b97ba0fa031d09509b05ab06176d5`	payload	2026-08-07	95%
sha1_hash	`0045f51bbd0f4285fc59b60f9652e6a6ad0f8242`	payload	2026-08-07	95%
md5_hash	`f3053fed83a4d313e8aa9cace5db69ab`	payload	2026-08-07	95%
sha256_hash	`2a73cad53d7b6ee5df6fce0d9f5761891c6bf42d674130dab5a634ffcd9b3423`	payload	2026-08-07	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - CrossRAT
let malicious_hashes = dynamic(["842c0ec2c16fd14a656b3caa6b0d93fc", "8a494cf5613a27de7739d417506a93aa98c51453230f61de36d18d53e5456d97", "0617b24e963b97ba0fa031d09509b05ab06176d5", "0045f51bbd0f4285fc59b60f9652e6a6ad0f8242", "f3053fed83a4d313e8aa9cace5db69ab", "2a73cad53d7b6ee5df6fce0d9f5761891c6bf42d674130dab5a634ffcd9b3423"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — CrossRAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: CrossRAT IOCs rule, including detailed contexts and suggested filters/exclusions:

Scenario: Automated Endpoint Security Updates via Scheduled Task
- Context: The enterprise uses Microsoft Defender for Endpoint or CrowdStrike Falcon, which runs a scheduled update job (e.g., UpdateService.exe) every morning at 03:00 AM. This process connects to the vendor’s cloud repository, triggering network connections to IOCs that overlap with CrossRAT indicators (specifically known benign IP ranges used by major AV vendors).
- Filter/Exclusion: Create a rule exclusion based on the Process Name (UpdateService.exe or falcon.sys) and the Parent Process ID. Additionally, exclude traffic originating from the specific Scheduled Task GUID associated with the vendor update job during the maintenance window (e.g., 02:00–04:00).
Scenario: Legitimate Cloud Backup Agent Communication
- Context: The organization utilizes Veeam Backup & Replication or Rubrik. The backup agents on workstations and servers periodically communicate with the central management server or cloud storage buckets. These agents often utilize standard ports and IP ranges that may share hash signatures or domain names with CrossRAT IOCs, particularly if the vendor has recently updated their certificate chain or API endpoints.
- Filter/Exclusion: Implement a filter excluding traffic where the Destination Port is 443 (HTTPS) AND the Source Process matches known backup agent executables (VeeamAgent.exe, rubrik-agent). Furthermore, exclude specific Domain Names associated with the cloud provider (e.g., *.vcloud.com, *.aws.amazon.com) if they match the IOCs.
**Scenario