ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt targets known indicators of compromise for ValleyRAT, a remote access trojan frequently used for initial access and lateral movement, by correlating specific network and host artifacts against active Azure Sentinel telemetry. Proactively hunting for these IOCs allows the SOC team to identify dormant or active ValleyRAT infections before they progress to data exfiltration or privilege escalation, thereby reducing the mean time to detection for this high-severity threat.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 6 IOC Types: sha256_hash, md5_hash, sha1_hash, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["202.79.166.26", "43.248.172.115"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["202.79.166.26", "43.248.172.115"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - ValleyRAT
let malicious_hashes = dynamic(["d3f5b2ed1b616c6302341f7a7736490e11b4b63081a22e6153d4a4c0a53d0a40", "3e9cf3f84058b4600342398c4d5218c551beea7b", "79d90eabf375fcae4bf76ed88d7d2c10"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ValleyRAT

False Positive Guidance

• Scenario: Development Team Deploying Custom .NET Assemblies

  • Context: A software development team compiles a new internal utility or library using .NET Framework 4.8. The resulting .exe or .dll file is copied to a shared network drive (\\fileserver\dev\builds\) for QA testing. ValleyRAT IOCs often target specific .NET assembly names or hash values that may coincidentally match generic build artifacts or specific class names used in the custom tool.
  • Filter/Exclusion: Exclude files located in known development build directories (e.g., \\fileserver\dev\, C:\Builds\) and exclude processes where the parent process is a known IDE or build tool (e.g., msbuild.exe, dotnet.exe, visualstudio.exe).

• Scenario: IT Admin Running Legacy Diagnostic Scripts

  • Context: An IT administrator runs a legacy PowerShell or VBScript-based diagnostic script (diag_check.vbs or net_diag.ps1) from a temporary directory (C:\Temp\ or C:\Users\%user%\AppData\Local\Temp\) to troubleshoot network connectivity issues. The script creates a small helper executable or uses a specific API call pattern that matches one of the 6 IOCs (e.g., specific registry key access or file creation pattern).
  • Filter/Exclusion: Exclude events where the process path contains AppData\Local\Temp or C:\Temp AND the parent process is powershell.exe, wscript.exe, or cscript.exe. Additionally, whitelist specific known diagnostic script names if they are frequently used.

• Scenario: Scheduled Backup Job Creating Temporary Files

  • Context: A scheduled task (BackupAgent.exe or VeeamBackup.exe) runs every night to