ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving known indicators of compromise (IOCs) from the ValleyRAT remote access trojan to identify potential lateral movement or data exfiltration attempts within the environment. A SOC team should proactively hunt for these signatures in Azure Sentinel because ValleyRAT is frequently used by threat actors to establish persistent footholds, and early detection allows for rapid containment before broader network compromise occurs.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["134.122.204.55"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["134.122.204.55"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ValleyRAT

False Positive Guidance

Here are the documented false positive scenarios and corresponding exclusions for the ThreatFox: ValleyRAT IOCs detection rule:

• Scenario: Legitimate Remote Administration via TeamViewer or AnyDesk

  • Context: Enterprise helpdesk teams frequently use remote desktop tools like TeamViewer or AnyDesk to troubleshoot user workstations. These applications often establish outbound connections to their respective cloud relay servers using specific domains and IP ranges that may overlap with ValleyRAT’s known command-and-control (C2) infrastructure, triggering the IOC match on DNS queries or network flow logs.
  • Suggested Filter: Create an exclusion rule allowing traffic from the TeamViewer and AnyDesk application hashes to bypass this detection for outbound connections to their official C2 domains (e.g., *.teamviewer.com, *.anydesk.com).

• Scenario: Scheduled Backup Jobs Utilizing Cloud Storage

  • Context: Automated backup agents such as Veeam Agent, Acronis Cyber Protect, or Microsoft Azure Backup run scheduled jobs during off-hours. These agents often synchronize with cloud storage endpoints that share IP ranges or certificate issuers similar to the ValleyRAT IOCs, causing false alerts when the agent initiates a large data transfer session.
  • Suggested Filter: Implement a time-based exclusion for the specific backup service accounts (e.g., DOMAIN\BackupSvc) during their defined maintenance windows (e.g., 02:00–04:00 local time), or whitelist the specific process paths of these backup agents.

• Scenario: Software Update Mechanisms from Vendor Ecosystems

  • Context: Critical enterprise software suites like Adobe Creative Cloud, Microsoft Office 365 ProPlus, and Cisco WebEx utilize aggressive update mechanisms that download patches from vendor-specific CDNs.