ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the execution of known ValleyRAT indicators to detect potential remote access trojan deployments within the Azure environment. Proactively hunting these specific IOCs in Azure Sentinel is critical because early identification allows the SOC team to isolate compromised endpoints before attackers establish persistent command-and-control channels or exfiltrate sensitive data.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`134[.]122[.]128[.]66:6666`	botnet_cc	2026-07-12	75%
ip:port	`134[.]122[.]128[.]66:8888`	botnet_cc	2026-07-12	75%
ip:port	`202[.]95[.]8[.]27:6666`	botnet_cc	2026-07-12	75%
ip:port	`202[.]95[.]8[.]27:8888`	botnet_cc	2026-07-12	75%
ip:port	`134[.]122[.]128[.]66:5050`	botnet_cc	2026-07-12	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["202.95.8.27", "134.122.128.66"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["202.95.8.27", "134.122.128.66"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — ValleyRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: ValleyRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Endpoint Protection Scanning of Quarantine Archives
- Scenario: The enterprise Endpoint Detection and Response (EDR) solution, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs a deep scan of the C:\ProgramData\ThreatFox\Quarantine directory. During this process, the EDR engine extracts archived threat intelligence feeds containing historical ValleyRAT samples for analysis, triggering the IOCs (specifically file hashes and network connections) even though no active infection exists on the host.
- Suggested Filter/Exclusion: Create an exclusion rule in the SIEM to suppress alerts where the Process Name is CrowdStrike.exe or MsMpEng.exe AND the Source Directory matches the known quarantine path (C:\ProgramData\ThreatFox\Quarantine).
Scheduled Vulnerability Assessment Scans
- Scenario: A weekly scheduled job using Tenable Nessus or Qualys runs a comprehensive vulnerability assessment across the “Dev-Test” subnet. The scanner downloads and executes test binaries from the ValleyRAT IOC set to verify patch levels and signature detection capabilities on virtual machines, generating legitimate network traffic and file creation events that match the rule’s logic.
- Suggested Filter/Exclusion: Implement a filter based on Source IP (the vulnerability management server) combined with a time-based condition (e.g., Time = 02:00 - 04:00 UTC) to exclude alerts generated during the standard maintenance window for these assessment jobs.
IT Admin Deployment of Security Baselines
- Scenario: The System Administration team utilizes **Microsoft