ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific indicators of compromise (IOCs) linked to the ValleyRAT remote access trojan, which is known for establishing persistent backdoors and exfiltrating sensitive data from compromised endpoints. The SOC team should proactively search for these IOCs within Azure Sentinel to identify early-stage infections before attackers can leverage their foothold to conduct lateral movement or data theft across the organization’s cloud infrastructure.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["156.247.40.131"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["156.247.40.131"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ValleyRAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: ValleyRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Security Tool Updates and Definition Refreshes

  • Context: Endpoint Detection and Response (EDR) agents or Antivirus solutions frequently download definition updates from vendor cloud repositories. If the ValleyRAT IOCs include specific file hashes or network destinations that overlap with a security vendor’s update server (e.g., CrowdStrike, SentinelOne, or Microsoft Defender), legitimate update traffic may trigger an alert.
  • Suggested Filter/Exclusion: Create a rule exclusion for processes belonging to known security vendors. For example, exclude alerts where the Process Name matches C:\Program Files\CrowdStrike\fsquint.exe, C:\Windows\System32\SentinelOne\SentinelService.exe, or C:\Program Files\Microsoft Defender Antivirus\MsMpEng.exe. Additionally, filter out network connections to known vendor update domains (e.g., *.microsoft.com, *.crowdstrike.com).

• Scenario: Scheduled Administrative Backup Jobs

  • Context: Enterprise backup solutions often run scheduled jobs during off-hours that involve scanning large volumes of data and communicating with central backup repositories. If ValleyRAT IOCs include specific registry keys or file paths commonly used by backup software (e.g., Veeam, Commvault, or Rubrik), the creation of temporary files or registry modifications by these tools can mimic RAT behavior.
  • Suggested Filter/Exclusion: Implement an exclusion based on Process Command Line containing keywords like “backup,” “snapshot,” or specific backup service names. Specifically, exclude alerts generated by processes such as Veeam.Backup.Service.exe, Commvault Agent Service (cvd.exe), or `RubrikAgent.exe