This hunt detects adversary behavior involving the deployment of CrossRAT malware by monitoring for specific Indicators of Compromise (IOCs) that signal active remote access trojan infections within the environment. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly identify and contain potential data exfiltration or lateral movement attacks before they escalate into broader security incidents.
Malware Family: CrossRAT Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha256_hash | 73827e53552bac53092a3f937f4c29d060969093cf20d9548836de516f2efede | payload | 2026-07-24 | 95% |
| sha1_hash | 4912001b000d5414dcaa0c3a0ef8cda8260ad920 | payload | 2026-07-24 | 95% |
| md5_hash | 9ce153849e117145877431ce9e43e110 | payload | 2026-07-24 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - CrossRAT
let malicious_hashes = dynamic(["73827e53552bac53092a3f937f4c29d060969093cf20d9548836de516f2efede", "4912001b000d5414dcaa0c3a0ef8cda8260ad920", "9ce153849e117145877431ce9e43e110"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: CrossRAT IOCs detection rule, tailored for an enterprise environment:
Endpoint Protection Engine Updates: The organization’s EDR solution (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) automatically downloads and installs definition updates from a vendor cloud repository. These update packages often contain hash signatures that match the CrossRAT IOCs because they are hosted on shared CDN infrastructure or utilize similar cryptographic libraries.
Process Name (e.g., MsMpEng.exe, FalconSensorService.exe) and restrict the rule to trigger only when the process is NOT running under a known service account (e.g., NT SERVICE\).Scheduled Software Deployment Jobs: IT administrators utilize configuration management tools like Microsoft SCCM or Ansible to push application patches during off-hours. The deployment agents frequently resolve dependencies from internal artifact repositories that host files with hashes matching the CrossRAT IOCs, triggering alerts when the agent processes these artifacts.
Parent Process Name is a known deployment tool (e.g., ccmsetup.exe, ansible-runner) and the execution time falls within the defined maintenance window (e.g., 02:00 – 06:00 local time).Internal DevOps Artifact Scanning: The security team runs automated vulnerability scans on internal Docker registries or CI/CD pipelines using tools like Trivy or JFrog Xray. These scanners download and analyze container images that include open-source libraries with hashes identical to the CrossRAT IOCs, generating alerts during the build phase rather than a malicious user session.