ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific indicators of compromise linked to the ValleyRAT remote access trojan, which is known for establishing persistent footholds and exfiltrating sensitive data from compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify early-stage infections before they escalate into broader lateral movement or data breach incidents within the organization’s cloud infrastructure.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`079d47dd089638b90a5741175e15760f`	payload	2026-08-15	95%
sha256_hash	`aafaddd58c513931655be4a52b11317283b500ef27608a83af45d4e625568d20`	payload	2026-08-15	95%
sha1_hash	`4068c64946bc4bafa70fba0bef12fd1568d62441`	payload	2026-08-15	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - ValleyRAT
let malicious_hashes = dynamic(["079d47dd089638b90a5741175e15760f", "aafaddd58c513931655be4a52b11317283b500ef27608a83af45d4e625568d20", "4068c64946bc4bafa70fba0bef12fd1568d62441"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — ValleyRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: ValleyRAT IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

Scenario: Scheduled Endpoint Protection Scans
- Context: Enterprise anti-virus solutions (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) often perform scheduled deep scans that generate network traffic matching ValleyRAT’s C2 beaconing patterns. The detection logic may flag the regular heartbeat of these agents as suspicious IOCs if they share similar port usage or TLS fingerprint characteristics with the threat.
- Filter/Exclusion: Create a rule exclusion based on the ProcessName and CommandLine. Exclude traffic where the process is MsMpEng.exe, C:\Program Files\Microsoft Defender Antivirus\bin\MsMpEng.exe, or C:\ProgramData\CrowdStrike\FalconSensor\csfalcon.exe during their scheduled maintenance windows (e.g., 02:00–04:00 UTC).
Scenario: Admin Deployment of Remote Management Tools
- Context: System administrators frequently deploy remote management tools like TeamViewer, AnyDesk, or Splunk Universal Forwarders to new workstations. These tools establish persistent connections and exchange telemetry data that closely mimics the ValleyRAT IOCs (specifically regarding DNS queries and outbound HTTPS traffic).
- Filter/Exclusion: Implement a filter excluding processes with specific ImagePaths associated with known management suites. For example, exclude any alert where the process path contains \TeamViewer\, \AnyDesk\, or \SplunkUniversalForwarder\. Additionally, whitelist the specific SHA-256 hashes of these legitimate binaries within the detection logic.
Scenario: Automated Patching and Update Services
- Context: The Windows Update service (`usoc.exe