ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the specific indicators of compromise (IOCs) linked to the ValleyRAT remote access tool, which is frequently used by threat actors for initial access and command-and-control operations. A proactive search in Azure Sentinel is critical because ValleyRAT often operates with low visibility in standard logs, making early identification essential to prevent lateral movement and data exfiltration before full compromise occurs.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 18 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	9e04e38658dc4c764ec10e04a9d50931	payload	2026-07-25	95%
md5_hash	d01940a0ebe8fd39c5358f39f069c1cd	payload	2026-07-25	95%
sha256_hash	0d542dca2b2948549a23cc166a3da8d599ea976fbc14506468ae9c2d32e34d70	payload	2026-07-25	95%
sha1_hash	3bc0486e1f918766dc29d19c8775e3bf720f8148	payload	2026-07-25	95%
sha1_hash	8aee9c6f38a36f3858373c256b6b8b63e1420a2d	payload	2026-07-25	95%
md5_hash	6a7608923c0a47054ae9d9f0347b88e7	payload	2026-07-25	95%
sha256_hash	7318f13b8621a236a1fad39d95ef779c6d3900ad10bb92997344931e51514306	payload	2026-07-25	95%
sha1_hash	70c444e2ee2b93d2ee076dd5c4b17a1dc5cd9cf9	payload	2026-07-25	95%
md5_hash	a5f3d83774db7701a2dcc96cd42f09c3	payload	2026-07-25	95%
sha256_hash	fda7ac256b2ff4c9e67a39f0fd307ea4b729386583a60767df2f148fdf8369c7	payload	2026-07-25	95%
sha256_hash	88785d2cf9afe24c80d363250875fe5e73d1c3232c8e66053ad2187eeacad97d	payload	2026-07-25	95%
sha1_hash	0f80690852a929322e1975d6968181fba4598e14	payload	2026-07-25	95%
sha256_hash	0beaa5ce9a409e12323af1630a44f6d61fb309f7f5f377b849588fa53241a884	payload	2026-07-25	95%
sha1_hash	c7c41e39c11b5cb69227a2b94bef71b3a395abfa	payload	2026-07-25	95%
md5_hash	b290f01d4988ccb3b0d67b89b79a3c63	payload	2026-07-25	95%
sha1_hash	d32bce7bdaae8b09c87e99657338ff8ac1befadd	payload	2026-07-25	95%
md5_hash	6fdfafd6ee99b1da17f1a01be789957d	payload	2026-07-25	95%
sha256_hash	c9dd2738abd8d9e66c00c2fe7affd710869b5a3232de632c00f5e67fd541cf39	payload	2026-07-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - ValleyRAT
let malicious_hashes = dynamic(["9e04e38658dc4c764ec10e04a9d50931", "d01940a0ebe8fd39c5358f39f069c1cd", "0d542dca2b2948549a23cc166a3da8d599ea976fbc14506468ae9c2d32e34d70", "3bc0486e1f918766dc29d19c8775e3bf720f8148", "8aee9c6f38a36f3858373c256b6b8b63e1420a2d", "6a7608923c0a47054ae9d9f0347b88e7", "7318f13b8621a236a1fad39d95ef779c6d3900ad10bb92997344931e51514306", "70c444e2ee2b93d2ee076dd5c4b17a1dc5cd9cf9", "a5f3d83774db7701a2dcc96cd42f09c3", "fda7ac256b2ff4c9e67a39f0fd307ea4b729386583a60767df2f148fdf8369c7", "88785d2cf9afe24c80d363250875fe5e73d1c3232c8e66053ad2187eeacad97d", "0f80690852a929322e1975d6968181fba4598e14", "0beaa5ce9a409e12323af1630a44f6d61fb309f7f5f377b849588fa53241a884", "c7c41e39c11b5cb69227a2b94bef71b3a395abfa", "b290f01d4988ccb3b0d67b89b79a3c63", "d32bce7bdaae8b09c87e99657338ff8ac1befadd", "6fdfafd6ee99b1da17f1a01be789957d", "c9dd2738abd8d9e66c00c2fe7affd710869b5a3232de632c00f5e67fd541cf39"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
DeviceFileEvents	Ensure this data connector is enabled

References

• ThreatFox — ValleyRAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: ValleyRAT IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Legitimate EDR/AV Definition Updates

  • Context: Enterprise Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne frequently download definition updates from their respective cloud repositories. These update packages often contain hash signatures that overlap with the ValleyRAT IOCs, specifically regarding the executable names or certificate issuers used in the threat intelligence feed.
  • Filter/Exclusion: Create a rule exclusion based on the process name of the EDR updater (e.g., C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe or C:\Windows\System32\defender\MsMpEng.exe) and restrict the detection to only trigger when the parent process is not a known system service. Additionally, exclude specific SHA-256 hashes of the latest update packages if they are static across the fleet.

• Scenario: Scheduled Administrative Backup Jobs

  • Context: Automated backup solutions such as Veeam Backup & Replication, Commvault, or Rubrik often utilize PowerShell scripts or custom agents to scan and transfer data. These tools may generate network traffic or file hashes that match the ValleyRAT IOCs, particularly if the backup agent uses a similar communication protocol or certificate authority (e.g., DigiCert or GlobalSign) as the threat actor.
  • Filter/Exclusion: Implement an exclusion based on the scheduled task name (e.g., VeeamTransportService or CommServe) and the execution time window (e.g., exclude alerts occurring between 01:00–05:00