This hunt detects adversary behavior involving the deployment of CrossRAT remote access trojan indicators, which are commonly used to establish persistent command and control channels on compromised endpoints. The SOC team should proactively hunt for these specific IOCs within Azure Sentinel to identify early-stage infections that may evade standard signature-based detection and prevent potential data exfiltration or lateral movement.
Malware Family: CrossRAT Total IOCs: 6 IOC Types: sha256_hash, md5_hash, sha1_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha256_hash | e5bccb979fef3945c64622c6ad4461947eca123465f2989d9f4af879fd467890 | payload | 2026-07-25 | 95% |
| sha1_hash | af381a40b1babd7f65f118608a958fc1aa48f115 | payload | 2026-07-25 | 95% |
| md5_hash | cc7e9ae7f054d90355af2dd379625ec3 | payload | 2026-07-25 | 95% |
| md5_hash | c29ddb54bb464846ba7e2de1d3eff471 | payload | 2026-07-25 | 95% |
| sha256_hash | 748c32e3718319e569d7a71eab5ace7589ed012764902b55475faab82a63c89b | payload | 2026-07-25 | 95% |
| sha1_hash | 49d293bee3fe99fbc0cf857347d9e5259dc41b94 | payload | 2026-07-25 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - CrossRAT
let malicious_hashes = dynamic(["e5bccb979fef3945c64622c6ad4461947eca123465f2989d9f4af879fd467890", "af381a40b1babd7f65f118608a958fc1aa48f115", "cc7e9ae7f054d90355af2dd379625ec3", "c29ddb54bb464846ba7e2de1d3eff471", "748c32e3718319e569d7a71eab5ace7589ed012764902b55475faab82a63c89b", "49d293bee3fe99fbc0cf857347d9e5259dc41b94"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: CrossRAT IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:
Endpoint Protection Engine Updates: The CrowdStrike Falcon or Microsoft Defender for Endpoint agents frequently download definition updates from vendor cloud repositories. If the update server IP or hash matches a known CrossRAT IOC (common in shared CDN infrastructure), the rule may trigger during nightly maintenance windows.
FalconSensor.exe or MsMpEng.exe) and restrict detection to non-business hours (e.g., 02:00–05:00) for these processes, or whitelist the specific vendor update server IP ranges.IT Admin Scheduled Backups: Enterprise backup solutions like Veeam Backup & Replication or Commvault often run scheduled jobs that connect to external storage gateways or cloud repositories. If a backup job connects to an external S3 bucket or NAS share that shares a network path with the CrossRAT IOC, legitimate data transfer will trigger the alert.
VeeamTransport.exe or commvault_agent.exe and the destination port matches standard backup ports (e.g., 9402 for Veeam). Additionally, whitelist the specific IP addresses of known enterprise storage gateways.Third-Party SaaS Integration Sync: Business applications such as Salesforce, ServiceNow, or Workday often perform automated synchronization tasks via webhooks or API connectors. These services may utilize shared IP ranges that overlap with CrossRAT IOCs during their daily data sync cycles (e.g., morning payroll runs).