ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt targets adversary activity involving the five specific indicators of compromise linked to the ValleyRAT remote access trojan, which is known for establishing persistent command-and-control channels and exfiltrating sensitive data. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification of this threat allows the SOC team to isolate affected endpoints before lateral movement occurs, thereby preventing potential credential theft and data loss across the organization’s cloud infrastructure.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`119[.]45[.]12[.]116:80`	botnet_cc	2026-07-01	75%
ip:port	`119[.]45[.]12[.]116:8888`	botnet_cc	2026-07-01	75%
ip:port	`104[.]143[.]33[.]78:10201`	botnet_cc	2026-07-01	75%
ip:port	`104[.]143[.]33[.]78:10202`	botnet_cc	2026-07-01	75%
ip:port	`119[.]45[.]12[.]116:6666`	botnet_cc	2026-07-01	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["104.143.33.78", "119.45.12.116"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["104.143.33.78", "119.45.12.116"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — ValleyRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: ValleyRAT IOCs detection rule, tailored for an enterprise environment:

Endpoint Protection Scanning of Quarantine Archives
- Scenario: The organization’s Endpoint Detection and Response (EDR) solution, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs a scheduled deep scan of the C:\ProgramData\Quarantine directory. This directory contains archived logs and isolated files from previous incidents that may include legacy ValleyRAT samples used for training or historical analysis. The EDR agent generates network traffic or file creation events matching the rule’s IOCs during this routine maintenance window (e.g., 02:00 UTC).
- Suggested Filter: Exclude traffic originating from the specific service account running the EDR agent (e.g., svc_defender_scan) and restrict the scope to the known quarantine file path (C:\ProgramData\Quarantine\*).
Software Deployment via Configuration Management
- Scenario: The IT Operations team utilizes Ansible or SCCM (System Center Configuration Manager) to deploy a new version of a remote access utility across the engineering subnet. During the deployment, the configuration management tool extracts and stages installer packages that include ValleyRAT components as part of a broader “Remote Support Suite” bundle. The extraction process triggers file hash matches against the 5 IOCs defined in the rule while running under the Local System or a dedicated DeployAdmin account.
- Suggested Filter: Create an exclusion for processes initiated by known configuration management binaries (e.g., ccmexec.exe, ansible-playbook) and filter on the specific OU (Organizational Unit) where these deployments are currently active, excluding them until the deployment cycle is complete.
Security Research Lab Traffic Simulation *