ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving known indicators of compromise (IOCs) linked to the ValleyRAT remote access trojan, which is frequently used for credential theft and lateral movement within enterprise networks. A proactive search in Azure Sentinel is critical because ValleyRAT often establishes persistent footholds that may evade standard signature-based detections until significant data exfiltration or privilege escalation occurs.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 2 IOC Types: url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["206.238.20.21"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["206.238.20.21"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - ValleyRAT
let malicious_urls = dynamic(["http://aidrmvo.cn/getinstall64"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ValleyRAT

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusions for the ThreatFox: ValleyRAT IOCs detection rule in an enterprise environment:

• Scenario: Scheduled Antivirus Definition Updates via Third-Party Agents

  • Context: Enterprise endpoints running CrowdStrike Falcon or Microsoft Defender for Endpoint often trigger background processes that download and install definition updates. These processes may utilize network sockets or file hashes that overlap with ValleyRAT’s known IOCs (specifically specific DLL names or registry keys used by legacy update mechanisms).
  • Filter/Exclusion: Create a rule exclusion based on the process name C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe and its child processes, specifically filtering out events where the parent process is WindowsUpdate or DefenderService.

• Scenario: Admin-Driven Patch Deployment via Configuration Management Tools

  • Context: During nightly maintenance windows, administrators using Microsoft SCCM (Configuration Manager) or Ansible Tower push security patches and configuration scripts. These tools often instantiate temporary service accounts that execute scripts matching ValleyRAT’s behavioral profile (e.g., creating specific registry keys under HKLM\Software or writing to the AppData directory).
  • Filter/Exclusion: Exclude events where the initiating user account is a known service account (e.g., DOMAIN\SYSADMIN, DOMAIN\SCCM_SERVICE) and the execution source path matches the central management server’s distribution point, such as \\SCCM-SRV01\D$.

• Scenario: Legacy Business Application Auto-Updates

  • Context: Critical line-of-business applications (e.g., SAP ERP, Oracle E-Business Suite, or specialized CAD software) often include built-in auto-updaters. These legacy components may utilize older DLL versions that