ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific indicators of compromise (IOCs) linked to the ValleyRAT remote access trojan, which is known for establishing persistent backdoors and exfiltrating sensitive data from compromised endpoints. Proactively hunting for these IOCs within Azure Sentinel allows the SOC team to identify early-stage infections before they escalate into broader lateral movement or data breaches across the organization’s cloud infrastructure.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`77d7a748ab647241403ab5741a7184501602877cc803ef33b6044feb5a708387`	payload	2026-08-01	95%
sha1_hash	`7fe65928be331e3acab2fb9c59eb13e86a900c6c`	payload	2026-08-01	95%
md5_hash	`bbd9cd5ee29a18fbf5d953abab877368`	payload	2026-08-01	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - ValleyRAT
let malicious_hashes = dynamic(["77d7a748ab647241403ab5741a7184501602877cc803ef33b6044feb5a708387", "7fe65928be331e3acab2fb9c59eb13e86a900c6c", "bbd9cd5ee29a18fbf5d953abab877368"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — ValleyRAT

False Positive Guidance

Here are the specific false positive scenarios and corresponding filters for the ThreatFox: ValleyRAT IOCs rule:

Scenario: Legitimate Software Deployment via SCCM/Intune
- Context: Enterprise IT teams frequently deploy internal utilities or security agents using Microsoft Endpoint Configuration Manager (SCCM) or Intune. If a deployed package contains a shared library, installer component, or embedded script that matches one of the ValleyRAT IOCs (e.g., a specific DLL hash or executable path), it will trigger an alert during mass deployment windows.
- Filter/Exclusion: Create a rule exclusion for processes spawned by ccmsetup.exe (SCCM) or Microsoft.IntuneManagementService.exe. Additionally, add the specific IOCs to the “Trusted Hash” allowlist if they are confirmed as part of standard internal deployment packages.
Scenario: Scheduled Maintenance Jobs on File Servers
- Context: Automated backup routines or log rotation scripts running via Windows Task Scheduler often utilize third-party tools (e.g., Veeam, Acronis, or custom PowerShell wrappers) that may share code signatures with ValleyRAT components. If a scheduled job executes during off-hours and accesses network shares using a tool matching the IOCs, it generates a false positive.
- Filter/Exclusion: Exclude alerts where the parent process is TaskScheduler.exe (or svchost.exe running the Task Scheduler service) and the execution time falls within defined maintenance windows (e.g., 02:00–04:00 local time).
Scenario: Development Environments Running Build Pipelines
- Context: In R&D departments, CI/CD pipelines (such as Jenkins, Azure DevOps Agents, or GitHub Actions runners) often compile code and execute test suites in containers or on build agents. These environments