ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt hypothesis targets adversaries utilizing ValleyRAT to establish encrypted command-and-control channels that facilitate data exfiltration while evading standard network monitoring through masqueraded software updates. Proactive hunting in Azure Sentinel is critical because ValleyRAT’s stealthy entry via phishing and its ability to maintain persistent system control can lead to significant data loss if not detected early through analysis of unusual outbound traffic and unexpected process executions.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 6 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`3ee9badaa810b2fb6db57e4644ec40c58e8fe15c6980059a3232a374df5ba4a3`	payload	2026-08-28	95%
sha1_hash	`b770903ba5c898d69db81dbafbd98f3eb32fc3fb`	payload	2026-08-28	95%
md5_hash	`4818c691ec402f0f2251f1a8d1d8a3b9`	payload	2026-08-28	95%
md5_hash	`846f4ed47a679e24505470f61d9110db`	payload	2026-08-28	95%
sha256_hash	`0bab062af7894bc44d68ebc5b9633a84ffaae1f17671ff3949002c43321ec86a`	payload	2026-08-28	95%
sha1_hash	`7be1989c25579401ac8638a889a1657d5182f7b8`	payload	2026-08-28	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - ValleyRAT
let malicious_hashes = dynamic(["3ee9badaa810b2fb6db57e4644ec40c58e8fe15c6980059a3232a374df5ba4a3", "b770903ba5c898d69db81dbafbd98f3eb32fc3fb", "4818c691ec402f0f2251f1a8d1d8a3b9", "846f4ed47a679e24505470f61d9110db", "0bab062af7894bc44d68ebc5b9633a84ffaae1f17671ff3949002c43321ec86a", "7be1989c25579401ac8638a889a1657d5182f7b8"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — ValleyRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: ValleyRAT IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

Scenario: Legitimate Software Update via Phishing Simulation
- Context: The organization runs quarterly security awareness training where users receive simulated phishing emails containing “Security Patch” attachments (e.g., .msi or .exe). When these legitimate installers execute, they may trigger the rule due to their encrypted C2-like outbound traffic and process behavior mimicking ValleyRAT’s initial installation phase.
- Filter/Exclusion: Exclude processes matching the specific hash of the training simulator tool (e.g., GoPhish or KnowBe4) running under the user context, specifically when the parent process is a known mail client like Outlook.exe or Thunderbird.
  - Logic: ProcessImageName IN ('GoPhishTrainer.exe', 'KB4Update.exe') AND ParentImageName IN ('outlook.exe', 'thunderbird.exe')
Scenario: Scheduled Remote Management Tool Execution
- Context: Enterprise IT teams utilize remote management tools (e.g., BeyondTrust, TeamViewer, or AnyDesk) that run scheduled jobs during off-hours to push configurations. These tools establish encrypted tunnels for system control and data exfiltration, which closely resemble ValleyRAT’s persistence and C2 mechanisms.
- Filter/Exclusion: Create a whitelist exclusion for the specific service accounts (e.g., DOMAIN\svc_remote_mgmt) executing these management agents during defined maintenance windows (e.g., Sundays 02:00–04:00).
  - Logic: `AccountName == ‘svc_remote_mgmt’ AND ProcessImageName IN (‘beyondtrust_agent.exe’, ‘TeamViewer_Service.exe’)