ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

The ThreatFox: ValleyRAT IOCs rule detects potential command and control communication associated with the ValleyRAT malware, which is known for exfiltrating sensitive data and establishing persistent access. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate advanced persistent threats before they cause significant data loss or system compromise.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["103.215.77.17", "203.91.74.204"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["103.215.77.17", "203.91.74.204"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ValleyRAT

False Positive Guidance

• Scenario: Legitimate scheduled job using schtasks.exe to run a maintenance script
  Filter/Exclusion: process.parent_process_name == "schtasks.exe" && process.command_line contains "schtasks /create /tn"

• Scenario: System update using wuauclt.exe (Windows Update Agent)
  Filter/Exclusion: process.name == "wuauclt.exe" || process.parent_process_name == "wuauclt.exe"

• Scenario: Admin task using taskhost.exe to execute a PowerShell script for log management
  Filter/Exclusion: process.parent_process_name == "taskhost.exe" && process.command_line contains "powershell.exe -File"

• Scenario: Security tool scan using mcafee_virus_scan.exe or avg_antivirus.exe
  Filter/Exclusion: process.name contains "mcafee_virus_scan" || process.name contains "avg_antivirus"

• Scenario: Database backup using sqlcmd.exe or mysqldump.exe
  Filter/Exclusion: process.name == "sqlcmd.exe" || process.name == "mysqldump.exe" || process.parent_process_name == "sqlservr.exe"