ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the specific indicators of compromise (IOCs) linked to the ValleyRAT remote access trojan, which is frequently used for initial access and persistent command-and-control operations. The SOC team should proactively hunt for these IOCs in Azure Sentinel to identify early-stage infections that may evade signature-based detection, thereby preventing potential data exfiltration or lateral movement before they escalate into broader incidents.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`aa1b178ea8f756e209b05880cfac8bbe`	payload	2026-07-31	95%
sha1_hash	`6afcf80b5ff082e4bd4ce860d7846a06b99463d9`	payload	2026-07-31	95%
sha256_hash	`2da611af6f3cad9f6829a476cfd47b8c4fd54e814024517da3aab2e4a81643b0`	payload	2026-07-31	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - ValleyRAT
let malicious_hashes = dynamic(["aa1b178ea8f756e209b05880cfac8bbe", "6afcf80b5ff082e4bd4ce860d7846a06b99463d9", "2da611af6f3cad9f6829a476cfd47b8c4fd54e814024517da3aab2e4a81643b0"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — ValleyRAT

False Positive Guidance

Here are the false positive scenarios and corresponding filters for the ThreatFox: ValleyRAT IOCs detection rule:

Scenario 1: Endpoint Security Agent Updates
- Context: The enterprise uses CrowdStrike Falcon or SentinelOne. During scheduled nightly maintenance, the security agent updates its definition database and telemetry modules. These update processes often generate network connections to vendor cloud endpoints that match the ValleyRAT IOCs (specifically C2 domains or certificate hashes).
- Suggested Filter: Create an exclusion based on the Process Name being FalconSensor.exe (or SentinelOneAgent.exe) and the Parent Process being the security service itself. Additionally, exclude traffic originating from the specific update server IP ranges provided by the vendor.
Scenario 2: Scheduled Backup Jobs via Cloud Storage
- Context: A nightly Veeam Backup & Replication job or a Microsoft Azure Backup agent runs on file servers to sync data to the cloud. The backup software establishes persistent connections to storage gateways that utilize SSL certificates or domain names identical to the ValleyRAT IOCs, triggering the rule during the backup window (e.g., 02:00 – 04:00 UTC).
- Suggested Filter: Implement a time-based exclusion for the specific Source Host groups identified as “Backup Servers” during the defined maintenance window. Alternatively, filter by Process Command Line containing keywords like vbr.exe or AzureBackupAgent.
Scenario 3: Admin Remote Management Sessions
- Context: System Administrators utilize Microsoft Endpoint Configuration Manager (MECM) or PDQ Deploy to push patches and scripts. When admins remotely execute PowerShell scripts or RDP sessions from the management server, the underlying network traffic often traverses through internal