ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity consistent with the ValleyRAT remote access trojan by identifying matches against its specific set of eleven indicators of compromise across network and endpoint telemetry. Proactively hunting for these IOCs in Azure Sentinel is critical to rapidly identify early-stage infections before they establish persistence or exfiltrate sensitive data from the environment.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 11 IOC Types: url, sha1_hash, ip:port, sha256_hash, md5_hash

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["154.91.74.87"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["154.91.74.87"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - ValleyRAT
let malicious_urls = dynamic(["http://43.198.235.91/getinstall64"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - ValleyRAT
let malicious_hashes = dynamic(["c20a54cc45596e10f5eaf83a388128fe", "7fb8478bfa214c20a0d4ed26b293501d39c475bc", "3a85be4f475378e774b44aafd20102cd", "04bc0dbf904d347bfa0b064bb436650fad0583b550dbd9450c8d00f4cb5a3b1b", "56ff460150b3ddeb5f1a01495ab44ee2", "551854f430801e8352f6562a48077cb04f399cdc505b42f0daaa3ad61d0e9f62", "9f4426b75d6dca82fb22a1f5ebfef3205ef78bca", "eee7db42470f6c58dc1e696ee937e87bd72f0cabe8df566021a79880d288e370", "b524c7848c2599868c1a39d57f4bfb261d194197"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ValleyRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: ValleyRAT IOCs detection rule, tailored for an enterprise environment:

• Endpoint Protection Scanning of Quarantine Archives

  • Scenario: The enterprise Endpoint Detection and Response (EDR) solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled deep scan of the C:\Quarantine directory. This directory contains archived, benign files previously flagged by legacy antivirus engines that happen to share hash values or file signatures with ValleyRAT components.
  • Filter/Exclusion: Exclude network traffic and process execution events originating from the EDR service account (e.g., svc_falcon or LocalSystem) specifically when accessing paths containing \Quarantine\, \VirusScan\, or \Temp\.

• Software Deployment via Configuration Management Tools

  • Scenario: The IT Operations team executes a scheduled deployment job using Ansible or SCCM (Microsoft Endpoint Configuration Manager) to push a standard utility package. This package includes a generic remote administration tool that utilizes a shared library component (e.g., libvalley.dll) which matches one of the 11 ValleyRAT IOCs, triggering an alert during the installation phase on target workstations.
  • Filter/Exclusion: Create an allow-list rule for process execution and network connections initiated by known deployment agents (e.g., ccmexec.exe, ansible-runner.exe) running under the Domain Admins or specific Deployment Service Account groups, excluding the specific IOC hash if it is confirmed as part of the approved software catalog.

• Legacy Application Maintenance and Patching

  • Scenario: A scheduled maintenance window triggers a background update for a critical legacy ERP module (e.g., SAP GUI or Oracle Financials). The patch installer extracts temporary files to