ThreatFox: CrossRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the specific indicators of compromise (IOCs) linked to the CrossRAT remote access trojan, which is frequently used by threat actors for initial access and lateral movement within compromised networks. The SOC team should proactively hunt for these IOCs in Azure Sentinel to identify early-stage infections that may evade standard signature-based detection, thereby preventing potential data exfiltration or command-and-control establishment before the malware fully embeds itself.

IOC Summary

Malware Family: CrossRAT Total IOCs: 6 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`13260e2e1ec04400403f6dfd4cb93994`	payload	2026-08-04	95%
md5_hash	`67e230755c1cf7cfc8d92a98c4caac13`	payload	2026-08-04	95%
sha256_hash	`53356890a6e72a151d869823f410ecf681731868d241c07ff02d51d6436c3dfd`	payload	2026-08-04	95%
sha1_hash	`f54e0ed941e989cfe030e0a7682d669b85612ab5`	payload	2026-08-04	95%
sha256_hash	`033eb7a351b65d9aa4e6a19a0be58ea87f579671fe54c3725129589f834c2d06`	payload	2026-08-04	95%
sha1_hash	`57f60f9ca384d9b29794de5446c8fe6fe4e214c2`	payload	2026-08-04	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - CrossRAT
let malicious_hashes = dynamic(["13260e2e1ec04400403f6dfd4cb93994", "67e230755c1cf7cfc8d92a98c4caac13", "53356890a6e72a151d869823f410ecf681731868d241c07ff02d51d6436c3dfd", "f54e0ed941e989cfe030e0a7682d669b85612ab5", "033eb7a351b65d9aa4e6a19a0be58ea87f579671fe54c3725129589f834c2d06", "57f60f9ca384d9b29794de5446c8fe6fe4e214c2"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — CrossRAT

False Positive Guidance

Here are 5 specific false positive scenarios and corresponding mitigation strategies for the ThreatFox: CrossRAT IOCs detection rule in an enterprise environment:

Scenario: Scheduled Antivirus Definition Updates via Microsoft Endpoint Manager
- Context: The organization uses Microsoft Intune to push daily definition updates. The update process involves downloading a large payload from a trusted vendor’s CDN, which matches the CrossRAT hash signature or network flow pattern due to overlapping file structures in the update installer.
- Filter/Exclusion: Create an exclusion rule for processes spawned by CmTask.exe (ConfigMgr Task) or IntuneManagementExtension.exe where the parent process is running under the SYSTEM account and the destination IP belongs to the trusted Microsoft CDN range (e.g., *.download.microsoft.com).
Scenario: Automated Backup Job Executing via Veeam Agent
- Context: A nightly backup job initiated by the Veeam Agent for Windows scans a directory containing legacy software installers. One of these installers contains a shared library (DLL) that shares a specific cryptographic hash with one of the CrossRAT IOCs, triggering an alert during the file indexing phase.
- Filter/Exclusion: Exclude alerts where the source process is VeeamAgent.exe and the file path resides within the designated backup root directory (e.g., C:\ProgramData\Veeam\Backup). Additionally, filter out events occurring strictly between 01:00 and 05:00 local time when this specific job runs.
Scenario: Deployment of Internal Development Tools via Ansible Tower
- Context: The DevOps team uses Ansible to deploy a custom internal utility tool to development servers. This utility includes a dependency library that mimics the network behavior or file hash of the CrossRAT IO