ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt targets adversary activity involving specific indicators of compromise linked to the ValleyRAT remote access trojan, which is known for establishing persistent command-and-control channels and exfiltrating sensitive data. Proactively hunting for these IOCs in Azure Sentinel is critical because early detection of this high-severity threat allows the SOC team to isolate compromised endpoints before lateral movement or significant data loss occurs.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 2 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["103.119.3.160"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["103.119.3.160"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ValleyRAT
let malicious_domains = dynamic(["ijt1.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — ValleyRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: ValleyRAT IOCs detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Protection Scanning of Quarantine Archives

  • Scenario: Enterprise Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, periodically scan the Quarantine or ThreatHistory folders. These directories often contain archived malware samples or historical logs that include ValleyRAT signatures from previous incidents. When the EDR engine re-scans these static files to update their internal threat database, the file hash or network artifact matches the detection rule’s IOCs, triggering an alert despite no active infection.
  • Suggested Filter/Exclusion: Create a path-based exclusion for directories known to store historical artifacts (e.g., C:\ProgramData\Microsoft\Windows Defender\Quarantine or specific CrowdStrike quarantine paths) and restrict the detection logic to only trigger on files with a “Created” timestamp within the last 24 hours.

• Software Development Build Pipelines

  • Scenario: In DevOps environments utilizing Jenkins or Azure DevOps, build agents frequently download open-source libraries, SDKs, and third-party dependencies to compile applications. If a development team is integrating a legacy Java library or a specific .NET component that shares a hash with the ValleyRAT IOCs (or if the CI/CD agent downloads a known benign version of the RAT for testing purposes), the network traffic or file creation event will match the rule. This often occurs during scheduled nightly builds triggered by Cron jobs or Task Scheduler.
  • Suggested Filter/Exclusion: Exclude host groups identified as “Build Agents” or “CI/CD Servers” from this specific detection rule, or add a filter to ignore network flows