ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the deployment of ValleyRAT remote access trojan by monitoring for specific indicators of compromise within the Azure Sentinel environment. Proactively hunting for these IOCs is critical to identify early-stage lateral movement and data exfiltration attempts before they escalate into broader network compromises.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 2 IOC Types: ip:port, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["95.41.30.246"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["95.41.30.246"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - ValleyRAT
let malicious_urls = dynamic(["https://aidksoflsf.cn:8443/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ValleyRAT

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: ValleyRAT IOCs detection rule in an enterprise environment:

• Scenario: Endpoint Security Agent Self-Updates

  • Context: The primary EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled self-update of its sensor components. These updates often utilize known ValleyRAT IOCs as part of their signature database or communication channels, triggering the rule when the agent connects to update servers.
  • Filter/Exclusion: Create an exclusion based on the Process Name and Parent Process. Exclude alerts where the process name matches the EDR sensor executable (e.g., csagent.exe, MsMpEng.exe) and the parent process is the specific EDR service manager, provided the file hash matches the latest known good version.

• Scenario: Scheduled Backup Job Execution

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault run nightly jobs that involve heavy network I/O and file enumeration. The backup agents often utilize communication protocols or specific DLLs that overlap with ValleyRAT IOCs, particularly when connecting to cloud repositories or scanning large data sets.
  • Filter/Exclusion: Implement a time-based exclusion window (e.g., 02:00 – 06:00 local time) combined with a Process Path filter. Exclude alerts where the process path resides within the backup vendor’s installation directory (e.g., C:\Program Files\Veeam\Backup and Replication\...) or matches specific scheduled task names like “Veeam Backup Service”.

• Scenario: IT Admin Remote Management Sessions

  • Context: System administrators frequently use remote management tools such as Microsoft SCCM (Configuration Manager) or Ivanti Neurons to push configurations or run scripts across