ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt detects ValleyRAT activity by identifying remote access trojan behaviors characterized by data exfiltration and persistent command-and-control connections established through specific IP:port pairs following phishing or download events. The SOC team should proactively search for these indicators in Azure Sentinel to rapidly identify stealthy lateral movement and potential data breaches before adversaries can fully establish a foothold within the network.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["103.112.99.160"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["103.112.99.160"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ValleyRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: ValleyRAT IOCs detection rule, including targeted filters and exclusions tailored for an enterprise environment:

• Scenario: Legitimate Remote Support Sessions via TeamViewer or AnyDesk

  • Context: Enterprise Help Desk teams frequently initiate remote support sessions using tools like TeamViewer, AnyDesk, or Splashtop. These applications establish persistent, stealthy C2-like connections to external IP addresses that may overlap with known ValleyRAT infrastructure ranges. The detection logic often flags these long-duration, high-bandwidth outbound connections as suspicious RAT activity.
  • Suggested Filter/Exclusion: Create an exclusion rule based on the Process Name and Executable Hash. Exclude traffic originating from TeamViewer.exe, AnyDesk.exe, or SplashtopAgent.exe where the process path matches the standard installation directory (e.g., C:\Program Files\TeamViewer\). Additionally, whitelist specific known support IP ranges provided by these vendors in your firewall policy.

• Scenario: Automated Cloud Backup and Synchronization Jobs

  • Context: Scheduled backup agents such as Veeam Agent, Carbonite, or OneDrive for Business run nightly jobs to exfiltrate large datasets to cloud storage endpoints. These jobs mimic the data exfiltration behavior of ValleyRAT, often connecting to specific IP:port pairs that match the rule’s IOCs, triggering alerts during peak backup windows (e.g., 02:00–04:00).
  • Suggested Filter/Exclusion: Implement a time-based exclusion for the detection rule. Configure the SIEM to suppress alerts for processes like VeeamAgent.exe, OneDrive.exe, or CarboniteService.exe during defined maintenance windows (e.g., 01:00–