ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior characterized by the execution of known ValleyRAT remote access trojan indicators to establish persistent command and control channels within the network. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early detection of this high-severity threat enables the SOC team to rapidly isolate compromised endpoints before sensitive data exfiltration occurs.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 2 IOC Types: url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["137.220.156.66"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["137.220.156.66"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - ValleyRAT
let malicious_urls = dynamic(["http://18.163.217.102/getinstall64"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ValleyRAT

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: ValleyRAT IOCs detection rule in an enterprise environment:

• Endpoint Protection Maintenance & Signature Updates

  • Scenario: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) performs a scheduled background update. During this process, the EDR agent downloads and executes a new definition package or a specific “ValleyRAT” threat intelligence module from the vendor’s repository. This legitimate executable may match the hash or file path IOCs defined in the ValleyRAT hunt package.
  • Filter/Exclusion: Create an exclusion rule to ignore alerts originating from known EDR service accounts (e.g., NT SERVICE\CrowdStrikeService, SYSTEM) and specific installation paths (e.g., C:\Program Files\CrowdStrike\ or C:\Windows\System32\Microsoft Defender Antivirus\).

• IT Asset Management & Software Inventory Scans

  • Scenario: A scheduled job using an asset management tool like ** Lansweeper**, ServiceNow Discovery, or SCCM (System Center Configuration Manager) runs a deep inventory scan. These tools often download and execute temporary agents or scripts to verify software versions on endpoints. If the ValleyRAT IOC list includes common utility names or hashes used by these inventory agents, they will trigger the rule during their routine weekly discovery cycles.
  • Filter/Exclusion: Exclude process paths associated with known asset management tools (e.g., C:\Program Files\Microsoft SCCM\ or C:\ProgramData\Lansweeper\) and restrict alerts to only those occurring outside of standard business hours if the scans are configured for off-peak execution.

• Third-Party Remote Support Sessions

  • Scenario: The IT Helpdesk utilizes