ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific indicators of compromise (IOCs) linked to the ValleyRAT remote access trojan, which is known for establishing persistent backdoors and exfiltrating sensitive data from compromised endpoints. A SOC team should proactively search for these IOCs within Azure Sentinel to identify early-stage infections that may have evaded standard signature-based detections, thereby preventing potential lateral movement and data loss before the threat escalates.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - ValleyRAT
let malicious_hashes = dynamic(["ac14f6dacdf01b8257412a33709a2891", "acbead7f0fbc8b7b392f2edb91c1a7ed6f9d96e2", "ebe31ad40a9ce206268d9f355e42ca4979847bfd861b3d157c06ed1bd842219c"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ValleyRAT

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusions for the ThreatFox: ValleyRAT IOCs detection rule in an enterprise environment:

• Scenario: A DevOps engineer executes a scheduled PowerShell script (Invoke-WebRequest) to pull security updates from a trusted internal repository that coincidentally hosts a file matching one of the ValleyRAT hash signatures.

  • Filter/Exclusion: Exclude alerts where the parent process is powershell.exe or pwsh.exe and the command line contains -ExecutionPolicy Bypass, specifically targeting the known internal repository URL (e.g., *.corp.internal).

• Scenario: The enterprise Endpoint Detection and Response (EDR) agent, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs a routine background scan that generates a temporary file in the %TEMP% directory matching a ValleyRAT IOCs hash.

  • Filter/Exclusion: Add an exclusion for files created by known EDR service processes (e.g., C:\Program Files\CrowdStrike\fs_qc.exe) or restrict the detection scope to exclude paths within C:\Windows\System32 and C:\ProgramData where EDR agents typically stage temporary artifacts.

• Scenario: An automated IT asset management tool, such as ServiceNow or SCCM (System Center Configuration Manager), deploys a patch package that includes a legacy utility binary matching the ValleyRAT IOCs signature during a nightly maintenance window.

  • Filter/Exclusion: Create a rule exclusion based on the ProcessName of the deployment engine (e.g., ccmsetup.exe or smstsvc.exe) and filter alerts occurring only during defined maintenance windows (e.g., Sunday 02:00–06:00 UTC).

• Scenario: A third-party Remote Desktop Gateway solution