ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the specific indicators of compromise (IOCs) linked to the ValleyRAT remote access trojan, which is known for establishing persistent backdoors and exfiltrating sensitive data from compromised endpoints. Proactively hunting for these IOCs within Azure Sentinel allows the SOC team to identify early-stage infections before they escalate into broader lateral movement or data breach incidents, ensuring rapid containment of this high-severity threat.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["103.199.102.28", "118.107.44.153"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["103.199.102.28", "118.107.44.153"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ValleyRAT

False Positive Guidance

• Scenario: Legitimate deployment of the ValleyRAT remote administration tool by the IT Operations team to manage a fleet of 50+ engineering workstations. The rule triggers because the installation package includes all three monitored IOCs (specific registry keys, file hashes, and network connections) as part of the standard rollout script.

  • Filter/Exclusion: Create an exclusion based on the Process Name (ValleyRAT_Installer.exe) running under a known Service Account (e.g., DOMAIN\svc-itops) or restrict detection to non-business hours if deployments are scheduled for nights/weekends.

• Scenario: A scheduled System Center Configuration Manager (SCCM) task sequence executes a software update that includes the ValleyRAT agent, triggering the rule due to the creation of specific registry keys and file artifacts defined in the IOCs on multiple endpoints simultaneously.

  • Filter/Exclusion: Exclude events where the Parent Process is ccmexec.exe or wuauserv.exe, as these indicate a managed deployment rather than a standalone user-initiated execution.

• Scenario: The Security Operations Center (SOC) runs a periodic threat hunting script using PowerShell to validate endpoint security posture, which actively queries the registry and scans file paths associated with ValleyRAT IOCs, causing the detection logic to fire on the scanning machine itself or target hosts.

  • Filter/Exclusion: Add an exclusion for processes spawned by powershell.exe where the command line contains specific keywords like -Command "Get-ItemProperty" or includes a tag in the event metadata identifying it as a “Scheduled Security Scan.”

• Scenario: An automated backup job using Veeam Backup & Replication performs an image-level backup of a virtual machine hosting the ValleyRAT management server, capturing the IOCs during the snapshot process and