ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This detection rule identifies adversary activity associated with the ValleyRAT remote access trojan by monitoring for specific Indicators of Compromise (IOCs) such as malicious file hashes and network connections. Proactively hunting for these signals in Azure Sentinel is critical to rapidly isolate compromised endpoints before attackers can establish persistence or exfiltrate sensitive data through this known threat actor’s infrastructure.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["154.82.93.242", "202.61.84.99"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["154.82.93.242", "202.61.84.99"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ValleyRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: ValleyRAT IOCs detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Management Software Updates

  • Scenario: The organization’s endpoint management suite (e.g., Microsoft Intune, Ivanti Neurons, or Tenable.io) performs scheduled agent updates. These agents often download payloads from the vendor’s cloud infrastructure, which may share IP addresses or hash signatures with ValleyRAT IOCs due to overlapping certificate authorities or shared CDN providers.
  • Suggested Filter: Exclude traffic originating from known internal management servers (e.g., 10.x.x.x range) and destination URLs containing specific vendor domains (e.g., *.microsoft.com, *.tenable.com). Additionally, whitelist the specific SHA-256 hashes of the official agent update packages.

• Automated Patch Deployment Jobs

  • Scenario: A scheduled PowerShell script or a third-party patching tool (such as SolarWinds Patch Manager or Chocolatey) runs nightly to distribute security patches across the fleet. During this process, the tools establish connections to external repositories that might be flagged by ValleyRAT indicators if those repositories host similar software components or utilize the same underlying frameworks.
  • Suggested Filter: Create an exclusion for processes running under the context of specific service accounts (e.g., svc-patch-deploy) and restrict alerts to non-business hours (01:00 – 05:00 local time) where these jobs are known to execute.

• Cloud Backup and Synchronization Services

  • Scenario: Enterprise backup solutions like Veeam Backup & Replication, Rubrik, or Microsoft Azure Arc perform incremental data synchronization. These tools frequently communicate with external cloud storage endpoints that may utilize IP