ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving known indicators of compromise (IOCs) from the ValleyRAT remote access trojan to identify potential lateral movement and data exfiltration attempts within the environment. A SOC team should proactively search for these specific IOCs in Azure Sentinel to rapidly validate early-stage infections before the malware establishes persistence or escalates privileges on critical assets.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 8 IOC Types: md5_hash, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["192.253.225.173", "103.45.66.18"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["192.253.225.173", "103.45.66.18"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - ValleyRAT
let malicious_hashes = dynamic(["07ddbbe2c71c45577a7a4fbcdba0df91", "8a626d844943da3456b044f38deae3a2", "c24e99f9437feacaa63766a3cde3fe3d"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ValleyRAT

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: ValleyRAT IOCs detection rule in an enterprise environment:

• Scenario: Legitimate Admin Use of Remote Management Tools

  • Context: System Administrators frequently utilize remote management suites like Microsoft SCCM (Configuration Manager) or Ivanti Neurons to deploy patches and scripts. These tools often execute PowerShell scripts or launch background processes that match the specific file hashes or network connection patterns defined in the ValleyRAT IOCs, particularly when communicating with internal update servers.
  • Filter/Exclusion: Create a detection rule exclusion based on ProcessName (e.g., ccmexec.exe, IvantiAgentService) and restrict the scope to trusted administrative accounts (e.g., UserPrincipalName containing \DOMAIN-Admins). Additionally, whitelist the specific internal IP ranges of the SCCM/Ivanti management servers in the network detection logic.

• Scenario: Scheduled Backup Jobs Utilizing Similar Cryptography

  • Context: Enterprise backup solutions such as Veeam Backup & Replication or Rubrik often run scheduled jobs that involve heavy file I/O and encrypted network transmission to offsite repositories. The cryptographic signatures used by these agents during the “pre-backup” handshake phase can mimic the IOCs associated with ValleyRAT’s command-and-control (C2) communication patterns, triggering alerts on port 443 traffic.
  • Filter/Exclusion: Implement a time-based exclusion window aligned with the backup schedule (e.g., 01:00–05:00 daily). Furthermore, add an exclusion for processes running under the specific service accounts used by the backup software (e.g., NT SERVICE\VeeamTransport) and whitelist the destination IP ranges of the backup storage clusters.

• **Scenario: