ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt hypothesis targets adversaries deploying the ValleyRAT remote access trojan to establish persistent command-and-control channels through specific IP:port pairs for data exfiltration and system manipulation. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly detect early-stage infections, prevent unauthorized data leakage, and mitigate the risk of long-term lateral movement within the network.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 10 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`95[.]41[.]36[.]198:443`	botnet_cc	2026-09-01	75%
ip:port	`185[.]9[.]17[.]250:443`	botnet_cc	2026-09-01	75%
ip:port	`95[.]40[.]176[.]172:8443`	botnet_cc	2026-09-01	75%
ip:port	`95[.]40[.]209[.]24:8443`	botnet_cc	2026-09-01	75%
ip:port	`95[.]41[.]69[.]117:8443`	botnet_cc	2026-09-01	75%
ip:port	`43[.]154[.]230[.]182:443`	botnet_cc	2026-09-01	75%
ip:port	`69[.]72[.]83[.]130:443`	botnet_cc	2026-09-01	75%
ip:port	`69[.]72[.]83[.]130:2083`	botnet_cc	2026-09-01	75%
ip:port	`69[.]72[.]83[.]130:2096`	botnet_cc	2026-09-01	75%
ip:port	`69[.]72[.]83[.]130:8443`	botnet_cc	2026-09-01	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["95.41.36.198", "95.40.209.24", "95.41.69.117", "69.72.83.130", "185.9.17.250", "95.40.176.172", "43.154.230.182"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["95.41.36.198", "95.40.209.24", "95.41.69.117", "69.72.83.130", "185.9.17.250", "95.40.176.172", "43.154.230.182"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — ValleyRAT

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: ValleyRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Scheduled Backup Agent Communication
- Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik often establish persistent connections to cloud storage gateways using specific IP:port pairs that may overlap with known ValleyRAT IOCs. These agents run as scheduled jobs during off-hours (e.g., 02:00–04:00) and initiate outbound traffic for data synchronization.
- Suggested Filter/Exclusion: Create an exclusion rule based on the Process Name (vbrsvc.exe, rubrik-agent) combined with a Time Window. Exclude alerts generated between 01:00 and 05:00 UTC where the source process is a known backup service, regardless of the destination IP.
Scenario: Remote Desktop Gateway Traffic from Admin Workstations
- Context: IT administrators frequently use tools like Microsoft Remote Desktop (mstsc.exe) or Citrix Workspace to connect to internal management servers via specific gateway IPs and ports (often 443, 8080, or custom RDP ports). If the ValleyRAT rule flags a common admin gateway IP as suspicious, legitimate remote management sessions will trigger false positives.
- Suggested Filter/Exclusion: Implement an exclusion for traffic originating from the Admin VLAN (e.g., subnet 192.168.10.0/24) where the destination port is 3389 or 443, and the user account belongs to the IT-Admins security group.
Scenario: Cloud SaaS Integration Webhooks