ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the execution of known ValleyRAT remote access trojan indicators to establish persistent command-and-control channels within the network. Proactively hunting these specific IOCs in Azure Sentinel is critical for early detection of lateral movement and data exfiltration attempts before they escalate into a full-scale compromise.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 7 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["95.41.4.54", "18.163.0.245", "154.36.188.90", "112.213.101.132"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["95.41.4.54", "18.163.0.245", "154.36.188.90", "112.213.101.132"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ValleyRAT
let malicious_domains = dynamic(["afdm.scloudflareb.com", "osgyx.cn", "qqdhq.cn"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — ValleyRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: ValleyRAT IOCs rule in an enterprise environment, along with suggested filters and exclusions:

• Endpoint Protection Scanning of Quarantine Archives

  • Scenario: Enterprise EDR solutions (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) frequently scan the Quarantine or Threats folders where they store previously detected malware samples. If a past ValleyRAT sample was quarantined, the scanning engine may re-trigger the detection logic on the static IOCs within that archive folder during routine integrity checks.
  • Filter/Exclusion: Exclude file paths containing specific EDR quarantine directories (e.g., C:\ProgramData\MSC\Antimalware\Quarantine or \CrowdStrike\Logs\Quarantine). Additionally, filter out events where the parent process is the EDR service itself (e.g., csagent.exe or MsMpEng.exe) rather than a user-facing application.

• IT Administration: Deployment of Legacy Training Modules

  • Scenario: The Learning & Development team may deploy legacy training software or “sandbox” environments for security awareness testing that utilize older versions of the ValleyRAT framework (or similar RATs) as part of their curriculum. When these modules are installed via Group Policy Objects (GPO) on a batch of 50+ workstations, they generate legitimate network connections to known ValleyRAT C2 IPs and file hashes.
  • Filter/Exclusion: Create an exclusion based on the specific GPO deployment name or the installation package hash. Alternatively, whitelist the source IP addresses used by the internal LMS (Learning Management System) server that distributes these training modules, ensuring traffic originating from this internal subnet is ignored for this rule.

• Scheduled Maintenance: Automated Patching and Configuration Scripts