This hunt targets known indicators of compromise associated with CrossRAT, a remote access trojan frequently used for initial access and lateral movement. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints early, mitigating the risk of persistent backdoors and data exfiltration before the adversary establishes deeper footholds in the environment.
Malware Family: CrossRAT Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha1_hash | 2cbd1f5b16cc5e17be51a801de7fed705a2336a5 | payload | 2026-09-24 | 95% |
| md5_hash | 0c7dd3b979c3fdeba56c6ae312345548 | payload | 2026-09-24 | 95% |
| sha256_hash | fb48f55e9e2b1ef2d904b0f06547ce698bcb151b43dd032fc7257a7c0f940bd4 | payload | 2026-09-24 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - CrossRAT
let malicious_hashes = dynamic(["2cbd1f5b16cc5e17be51a801de7fed705a2336a5", "0c7dd3b979c3fdeba56c6ae312345548", "fb48f55e9e2b1ef2d904b0f06547ce698bcb151b43dd032fc7257a7c0f940bd4"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Legacy Java Application Deployment: CrossRAT often uses specific Java class names or JAR file hashes. In enterprise environments running legacy Java applications (e.g., custom internal tools built with older versions of Spring or Hibernate), the deployment of updated JARs via tools like Ansible or Chef may result in file hashes or class names that match the IOCs.
java.exe or jre.exe and the file path resides within known application directories (e.g., C:\Program Files\InternalApp\lib\), or exclude specific JAR file names known to be part of the internal application stack.Scheduled Maintenance Scripts: CrossRAT may install itself in user temp folders or use specific mutex names. Legitimate enterprise maintenance tasks, such as Windows Task Scheduler jobs running PowerShell scripts to clean up temp files or update internal plugins, might create temporary files or mutexes that align with the IOC patterns if the script uses generic naming conventions.
svchost.exe (Task Scheduler service) or powershell.exe and the command line contains known maintenance keywords (e.g., -Cleanup, -Update, -Maintenance) or originates from a trusted script directory (e.g., C:\Scripts\Maintenance\).Third-Party Remote Support Tools: Some commercial remote support tools (e.g., TeamViewer, AnyDesk, or LogMeIn) may use similar communication ports, specific service names, or file locations that overlap with CrossRAT IOCs, particularly if they install helper services in C:\Program Files\ or use specific registry keys for persistence.