ThreatFox: CrossRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior characterized by the execution of known CrossRAT remote access trojan indicators, which typically establish persistence and exfiltrate sensitive data from compromised endpoints. Proactively hunting for these specific IOCs within Azure Sentinel is critical to rapidly identify early-stage infections before they escalate into widespread lateral movement or significant data breaches across the organization’s cloud infrastructure.

IOC Summary

Malware Family: CrossRAT Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`2b4e83cfdab5b79ae1aa1b4df8dd4503a9c99deb`	payload	2026-06-27	95%
md5_hash	`038112c489a65525aaa6c2ede6c33c2a`	payload	2026-06-27	95%
sha256_hash	`737646392a7c882064e22ecb9fc0b2732399e44ced2f56d873e656d0035af288`	payload	2026-06-27	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - CrossRAT
let malicious_hashes = dynamic(["2b4e83cfdab5b79ae1aa1b4df8dd4503a9c99deb", "038112c489a65525aaa6c2ede6c33c2a", "737646392a7c882064e22ecb9fc0b2732399e44ced2f56d873e656d0035af288"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — CrossRAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: CrossRAT IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Endpoint Protection Scanning of Quarantine Archives
- Scenario: The organization’s Endpoint Detection and Response (EDR) solution, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs a scheduled deep scan of the “Quarantine” or “History” folders. These folders often contain archived malware samples from previous incidents (including CrossRAT variants) that were previously identified and neutralized by the security team. The EDR engine re-scans these static files, triggering the detection logic against known IOCs within the archive itself rather than active malicious behavior.
- Filter/Exclusion: Exclude file paths containing specific quarantine directories (e.g., C:\ProgramData\Microsoft\Windows Defender\Scans\History\Malware or C:\CrowdStrike\Logs\Quarantine) from generating alerts for this rule, provided the file creation timestamp is older than 30 days.
Software Deployment via Configuration Management Tools
- Scenario: During a routine patch Tuesday cycle, the IT operations team uses Ansible or SCCM (System Center Configuration Manager) to deploy a new version of a third-party utility that includes a bundled Java Runtime Environment (JRE) or a specific browser extension. The deployment package contains legitimate binaries that share hash values or network signatures with CrossRAT IOCs because the software vendor uses standard libraries common in the CrossRAT family.
- Filter/Exclusion: Create an exclusion based on the Process Name and Parent Process. If the initiating process is a known deployment agent (e.g., ccmexec.exe, ansible-runner.exe) or the file path resides within the software distribution share (e