ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt identifies potential ValleyRAT infections by matching known indicators of compromise against Azure Sentinel telemetry to detect the presence of this remote access trojan. Proactively hunting for these IOCs is critical because ValleyRAT enables adversaries to establish persistent command-and-control channels, allowing for data exfiltration and lateral movement that may go unnoticed in standard monitoring.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["202.61.85.180", "156.233.235.141"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["202.61.85.180", "156.233.235.141"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ValleyRAT

False Positive Guidance

• Scenario: A security operations team or incident response (IR) engineer manually executes a netsh command to configure a temporary proxy or firewall rule during a network troubleshooting session, which matches the specific netsh IOC string.
  • Filter/Exclusion: Exclude events where the command line contains netsh and the parent process is cmd.exe or powershell.exe initiated by a user account with the SecurityOps or ITAdmin group membership, provided the command does not contain the specific ValleyRAT payload signature (e.g., add interface portproxy).
• Scenario: A legacy application or custom script uses regsvr32 to register a COM object for a specific business logic component, matching the regsvr32 IOC path or parameters.
  • Filter/Exclusion: Exclude regsvr32 executions where the DLL path resides in a known trusted directory (e.g., C:\Program Files\CorpApp\bin\) and the parent process is a recognized service executable (e.g., CorpAppService.exe), excluding generic system paths like C:\Windows\System32 unless the DLL name matches a known ValleyRAT hash.
• Scenario: An automated backup or data exfiltration test job uses certutil to encode or decode a test file, triggering the certutil IOC.
  • Filter/Exclusion: Exclude certutil commands containing -encode or -decode where the source or destination file path is located in a designated backup or temp directory (e.g., C:\Backups\ or C:\Temp\) and the parent process is a scheduled task service (e.g., Svchost.exe running the specific backup task), ensuring the file size is under a defined threshold (e.g., 50