ValleyRAT is a remote access trojan that adversaries deploy to establish persistent control and exfiltrate data, making its presence a critical indicator of active compromise. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify infected endpoints before the malware can fully establish its foothold and escalate privileges within the environment.
Malware Family: ValleyRAT Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 192[.]252[.]187[.]52:357 | botnet_cc | 2026-09-13 | 100% |
| ip:port | 192[.]252[.]187[.]52:358 | botnet_cc | 2026-09-13 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["192.252.187.52"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["192.252.187.52"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Legacy Java Application Deployment: ValleyRAT IOCs often include specific Java class names or JAR file hashes associated with the malware’s dropper. In environments running legacy enterprise applications (e.g., old versions of SAP, Oracle, or custom internal tools) that use similar Java packaging structures, the detection may trigger on legitimate application updates or deployments.
C:\Program Files\LegacyApp\lib\) or specific JAR filenames (e.g., app-core.jar) that are part of the application’s standard deployment package, verified by the application owner.Scheduled Maintenance Scripts: ValleyRAT may use PowerShell or batch scripts to establish persistence or download payloads. Legitimate IT operations teams often run scheduled PowerShell scripts for log cleanup, disk space management, or software patching that may match the IOCs if they use similar command-line patterns or temporary file locations (e.g., %TEMP% or %APPDATA%).
SYSTEM or Administrator account from known service accounts (e.g., svc-maintenance) and restrict exclusions to scripts located in standard IT operations directories (e.g., C:\Scripts\Maintenance\), ensuring the script hash matches a known good baseline.Third-Party Remote Support Tools: Some remote support or monitoring agents (e.g., TeamViewer, ConnectWise Control, or custom internal RMM tools) may download or execute components in locations or with naming conventions that overlap with ValleyRAT’s IOCs, particularly if they use generic names like update.exe or helper.dll in user profile directories.
tv_w32.exe