ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving five specific indicators of compromise (IOCs) linked to the ValleyRAT remote access trojan, which are known to facilitate credential theft and lateral movement within compromised networks. The SOC team should proactively search for these IOCs in Azure Sentinel because early identification of ValleyRAT presence allows for immediate containment before attackers can establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 5 IOC Types: ip:port, sha1_hash, sha256_hash, md5_hash

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["43.132.212.50"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["43.132.212.50"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - ValleyRAT
let malicious_hashes = dynamic(["079d47dd089638b90a5741175e15760f", "aafaddd58c513931655be4a52b11317283b500ef27608a83af45d4e625568d20", "4068c64946bc4bafa70fba0bef12fd1568d62441"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ValleyRAT

False Positive Guidance

Here are the false positive scenarios and corresponding exclusion strategies for the ThreatFox: ValleyRAT IOCs detection rule:

• Legitimate Enterprise Backup Operations

  • Scenario: The enterprise backup solution (e.g., Veeam Backup & Replication or Commvault) executes nightly scheduled jobs that generate specific hash values matching the ValleyRAT IOCs. These backups often involve large file transfers and process spawning that mimic RAT behavior, particularly when the backup agent communicates with the central repository server using similar network patterns to the threat’s C2 traffic.
  • Filter/Exclusion: Create a rule exclusion based on the specific Process Name of the backup agent (e.g., vbr.exe or commvault.cmd) and restrict the detection scope to exclude the Backup Server Subnet. Alternatively, add the known good SHA-256 hashes of the backup agents to the IOC allow-list.

• Software Deployment via Configuration Management

  • Scenario: The IT team utilizes Microsoft Endpoint Configuration Manager (SCCM) or Ansible to push application updates and patches during maintenance windows. The deployment engine often spawns temporary processes that download payloads from internal repositories, triggering the ValleyRAT file integrity checks due to identical file signatures used in the deployment packages.
  • Filter/Exclusion: Implement a filter that excludes alerts where the parent process is ccmexec.exe (SCCM) or ansible-playbook. Additionally, configure the detection logic to ignore events occurring within defined Maintenance Windows (e.g., Sundays 02:00–06:00 UTC) for these specific deployment accounts.

• Internal Security Scanning and EDR Telemetry

  • Scenario: The organization’s primary Endpoint Detection and Response (EDR) solution, such as CrowdStrike Falcon or **Sent