ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific indicators of compromise (IOCs) linked to the ValleyRAT remote access trojan, which is known for establishing persistent footholds and exfiltrating sensitive data from compromised endpoints. The SOC team should proactively search for these IOCs within Azure Sentinel to identify early-stage infections before the malware can fully establish command-and-control channels or escalate privileges across the enterprise network.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 12 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["18.167.217.149", "18.167.107.230", "95.41.64.117", "43.198.220.74", "18.166.189.193", "43.198.145.140", "95.40.206.48"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["18.167.217.149", "18.167.107.230", "95.41.64.117", "43.198.220.74", "18.166.189.193", "43.198.145.140", "95.40.206.48"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ValleyRAT
let malicious_domains = dynamic(["utuhv.cn", "wwwvbcsajmj.cn", "xxnoyhngfg.cn", "etgul.cn", "hhwqascxsdr.cc"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — ValleyRAT

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: ValleyRAT IOCs detection rule:

• Scenario: A DevOps engineer manually executes a custom PowerShell script on a build server to validate software dependencies. The script contains a hash or URL that matches one of the 12 ValleyRAT IOCs (e.g., a specific DLL name like valley_update.dll used in an internal CI/CD pipeline), triggering an alert when the engineer runs Get-Process or downloads artifacts.

  • Filter/Exclusion: Create a filter to exclude alerts where the source process is powershell.exe running under a known service account (e.g., DOMAIN\DevOps-Build-Svc) and the file path resides within the designated build directory (D:\CI\Pipelines\Scripts).

• Scenario: The IT department deploys a scheduled maintenance job using Microsoft System Center Configuration Manager (SCCM) to push a security update. The deployment package includes a temporary executable named ValleyCheck.exe which shares an identical file hash with the ValleyRAT IOC, causing the rule to fire during the nightly maintenance window between 02:00 and 04:00 UTC.

  • Filter/Exclusion: Implement a time-based exclusion that suppresses alerts for this specific IOC when the event timestamp falls within the 02:00–04:00 UTC window on any host tagged with the “SCCM-Client” tag, or explicitly whitelist the SCCM service account (DOMAIN\SCCM-Svc) as a trusted source.

• Scenario: A third-party vendor application installed on finance workstations utilizes a legacy update mechanism that downloads configuration files from an internal repository. The URL used for this download matches one of the ValleyRAT network IOCs, generating alerts every morning when users launch the financial reporting tool during peak