ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving known indicators of compromise (IOCs) linked to the ValleyRAT remote access trojan, which is frequently used for credential theft and lateral movement within enterprise networks. The SOC team should proactively search for these IOCs in Azure Sentinel to identify early-stage infections before attackers establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["170.62.130.47"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["170.62.130.47"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ValleyRAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: ValleyRAT IOCs rule, along with suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Endpoint Protection Scanning of Quarantine Archives

  • Context: Enterprise EDR agents (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) periodically scan the local quarantine folder where previous detections are stored. If a previously flagged ValleyRAT artifact remains in the quarantine database, the agent’s background scanning process may re-trigger the IOCs as active network traffic or file access events.
  • Filter/Exclusion: Exclude processes originating from MsMpEng.exe (Microsoft Defender) or C-Host.exe (CrowdStrike) when accessing paths containing \Quarantine\ or \Threats\. Additionally, filter out events where the process command line includes flags like /scan-quarantine or similar maintenance parameters.

• Scenario: Automated Software Deployment via SCCM/Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune pushes a software update package that includes a dependency library or installer component matching a ValleyRAT hash. During the deployment phase, the installation service (ccmsetup.exe or intunagent.exe) extracts and executes this file, triggering the detection logic as if it were a malicious execution.
  • Filter/Exclusion: Create an exclusion for process names ccmsetup.exe, msiexec.exe, and intunagent.exe. Specifically, filter events where the parent process is one of these deployment tools and the file path resides within standard software distribution directories (e.g., C:\Windows\CCM\ or C:\ProgramData\Microsoft Intune Management Extension).

• Scenario: Scheduled PowerShell Maintenance Scripts

  • Context: IT operations teams utilize