ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the execution of known ValleyRAT indicators to detect active reconnaissance and data exfiltration campaigns within the environment. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early identification of this high-severity threat allows the SOC team to contain potential lateral movement before sensitive data is compromised.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 9 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`c20a54cc45596e10f5eaf83a388128fe`	payload	2026-07-16	95%
sha1_hash	`7fb8478bfa214c20a0d4ed26b293501d39c475bc`	payload	2026-07-16	95%
md5_hash	`3a85be4f475378e774b44aafd20102cd`	payload	2026-07-16	95%
sha256_hash	`04bc0dbf904d347bfa0b064bb436650fad0583b550dbd9450c8d00f4cb5a3b1b`	payload	2026-07-16	95%
md5_hash	`56ff460150b3ddeb5f1a01495ab44ee2`	payload	2026-07-16	95%
sha256_hash	`551854f430801e8352f6562a48077cb04f399cdc505b42f0daaa3ad61d0e9f62`	payload	2026-07-16	95%
sha1_hash	`9f4426b75d6dca82fb22a1f5ebfef3205ef78bca`	payload	2026-07-16	95%
sha256_hash	`eee7db42470f6c58dc1e696ee937e87bd72f0cabe8df566021a79880d288e370`	payload	2026-07-16	95%
sha1_hash	`b524c7848c2599868c1a39d57f4bfb261d194197`	payload	2026-07-16	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - ValleyRAT
let malicious_hashes = dynamic(["c20a54cc45596e10f5eaf83a388128fe", "7fb8478bfa214c20a0d4ed26b293501d39c475bc", "3a85be4f475378e774b44aafd20102cd", "04bc0dbf904d347bfa0b064bb436650fad0583b550dbd9450c8d00f4cb5a3b1b", "56ff460150b3ddeb5f1a01495ab44ee2", "551854f430801e8352f6562a48077cb04f399cdc505b42f0daaa3ad61d0e9f62", "9f4426b75d6dca82fb22a1f5ebfef3205ef78bca", "eee7db42470f6c58dc1e696ee937e87bd72f0cabe8df566021a79880d288e370", "b524c7848c2599868c1a39d57f4bfb261d194197"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — ValleyRAT

False Positive Guidance

Here are four specific false positive scenarios for the ThreatFox: ValleyRAT IOCs detection rule in an enterprise environment, along with recommended filters and exclusions:

Legitimate Software Deployment via SCCM/Intune
- Scenario: The IT Operations team deploys a new version of a remote management agent (e.g., Ivanti or Microsoft Endpoint Configuration Manager) that includes a background service executable matching the ValleyRAT hash. This occurs during the standard Tuesday maintenance window, triggering alerts on hundreds of endpoints simultaneously as the installer writes files to C:\Program Files\Valley.
- Filter/Exclusion: Create an exclusion rule based on the Process Parent being the deployment engine (e.g., ccmexec.exe or intune-management-agent-extensions.exe). Additionally, exclude alerts where the User Account is a known service account used for patching (e.g., svc-deploy-admin) rather than an interactive user.
Scheduled Antivirus Definition Updates
- Scenario: The enterprise endpoint protection suite (e.g., CrowdStrike or SentinelOne) performs its scheduled nightly definition update. The update package contains a heuristic scan engine module that shares a specific IOCs signature with ValleyRAT, particularly the network connection to the vendor’s update server on port 443 which matches the rule’s network flow criteria.
- Filter/Exclusion: Implement a time-based filter to suppress alerts between 02:00 and 04:00 UTC (the standard maintenance window). Furthermore, exclude traffic originating from the specific Destination IP ranges of the antivirus vendor’s update servers if they overlap with the ValleyRAT IOCs list.
Administrative Remote Access Sessions
- Scenario: A System Administrator initiates a remote session using a third-party RDP gateway (e.g.,