ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt hypothesis detects adversary behavior involving the deployment of ValleyRAT remote access trojans by monitoring for specific indicators of compromise such as malicious hashes and network connections. A SOC team should proactively hunt for these IOCs in Azure Sentinel to identify early-stage lateral movement and data exfiltration attempts that could lead to significant credential theft or persistent unauthorized access.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 6 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`8[.]210[.]155[.]34:6868`	botnet_cc	2026-08-13	100%
ip:port	`118[.]107[.]9[.]161:1112`	botnet_cc	2026-08-13	75%
ip:port	`118[.]107[.]9[.]161:1113`	botnet_cc	2026-08-13	100%
ip:port	`103[.]30[.]7[.]55:8477`	botnet_cc	2026-08-13	100%
ip:port	`161[.]248[.]14[.]213:443`	botnet_cc	2026-08-13	75%
ip:port	`161[.]248[.]14[.]213:80`	botnet_cc	2026-08-13	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["103.30.7.55", "118.107.9.161", "8.210.155.34", "161.248.14.213"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["103.30.7.55", "118.107.9.161", "8.210.155.34", "161.248.14.213"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — ValleyRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: ValleyRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Legitimate Endpoint Management Agent Updates
- Scenario: Enterprise deployment of Microsoft System Center Configuration Manager (SCCM) or Ivanti Neurons triggers a background process that downloads and executes update packages. These agents often utilize network connections to vendor repositories that match the ValleyRAT hash signatures or URL patterns, specifically when the agent performs a “silent install” during off-hours.
- Filter/Exclusion: Exclude processes where ProcessName matches ccmexec.exe (SCCM) or IvantiAgentService.exe AND the parent process is a known service account (NT SERVICE\*). Additionally, filter out network traffic originating from internal IP ranges dedicated to patch management servers.
Scheduled Data Backup and Archiving Jobs
- Scenario: Automated backup solutions like Veeam Backup & Replication or Commvault run scheduled jobs that compress large datasets and transmit them over the network. The compression engine or the transfer module may generate file hashes or execute scripts that inadvertently match the ValleyRAT IOCs, particularly if the backup software uses a generic scripting language interpreter (e.g., PowerShell) to orchestrate the job.
- Filter/Exclusion: Create an exclusion rule for ProcessName containing VeeamAgent.exe, commvault.cmd, or vssvc.exe. Furthermore, exclude alerts where the execution context is a “Task Scheduler” job (SchTasks) with a name prefix of [Backup]_ or [Archive]_.
Third-Party Antivirus Cloud Intelligence Queries
- Scenario: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon, **Sent