ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the execution of known ValleyRAT indicators of compromise to identify potential remote access trojan infections within the environment. The SOC team should proactively search for these IOCs in Azure Sentinel to rapidly discover and contain early-stage compromises that could lead to credential theft or lateral movement before they escalate into broader incidents.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 15 IOC Types: sha1_hash, md5_hash, sha256_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - ValleyRAT
let malicious_hashes = dynamic(["ee2579b3b0776a20be98c1cb605cd7eb39909951320b375e6aacfbd230104572", "2e26a2fbd74b1e40119e1031d4776d1c55efcf5c", "59ae169e146ffcc328c53b0feade92cb", "00df868e2b8a8f4014ac129bb65bb8b0d7e196966e5b30b44390dbb3914d219e", "42e83488d452064f0628a22bb038d36fc1e45d3e", "9165819cd48cc6eb816b22a27f85aefe", "7d6142cfa025c44c947588f283c0275db4a24802", "8e168e0cacef78f10dc13a69d5bd0b1a", "0b1d575c0c0a08ef48683113372d7580a42acfac4442a3927314b86dff616c4e", "41cb7ed17731f8c1561399b381f42de3febcd6be", "51f9befcc514d4468197647968767773", "a2a89a44d71f06730e57843f96ade00667b4f90a", "5021094d588a1cc1f2cc9b61c717fda6", "de993daff7d97c547bc608c9e5f0233ca1f420adb4931d8615171c7ec8182849", "99328f02c062e6f2d52c257e7df219789f9ef0d9167444b2d123c78bba75362b"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ValleyRAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: ValleyRAT IOCs detection rule, along with recommended filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Endpoint Protection Scans

  • Context: Enterprise security suites like CrowdStrike Falcon, Microsoft Defender for Endpoint (MDE), or Carbon Black frequently download updated threat intelligence feeds or perform scheduled scans that match the specific file hashes or network patterns of ValleyRAT IOCs. These legitimate updates often trigger alerts when the detection logic matches a known benign hash against the malicious IOC list.
  • Suggested Filter/Exclusion: Create an exclusion rule based on Process Name and Parent Process. Exclude any event where the process name is CrowdStrike.exe, MsMpEng.exe (MDE), or cbp.exe (Carbon Black) AND the parent process is a known security service (e.g., svchost.exe running under the “System” account). Additionally, filter out events occurring during the defined maintenance window (e.g., 02:00–04:00 local time).

• Scenario: IT Admin Deployment via Configuration Management

  • Context: During routine software patching or application deployment using tools like Microsoft SCCM (Configuration Manager), Ansible, or Jenkins, administrators often push scripts or installers that utilize the same network ports and file signatures as ValleyRAT. For instance, a PowerShell script executed by ccmexec.exe might download a payload from an internal repository that matches a ValleyRAT network IOC.
  • Suggested Filter/Exclusion: Implement a filter based on User Context and Source IP. Exclude events where the initiating user account belongs to the “IT_Operations” or “Helpdesk_Admin” security group, OR where the source