ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This detection identifies adversary activity involving three specific indicators of compromise linked to the ValleyRAT remote access trojan, which is known for establishing persistent footholds and exfiltrating sensitive data from compromised endpoints. Proactively hunting for these IOCs within Azure Sentinel is critical to rapidly identify early-stage infections before adversaries can leverage their command-and-control infrastructure to escalate privileges or move laterally across the network.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["161.248.14.209", "156.225.94.168"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["161.248.14.209", "156.225.94.168"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ValleyRAT

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: ValleyRAT IOCs detection rule in an enterprise environment:

• Scenario: Legitimate Remote Management Tools

  • Context: Enterprise IT teams often deploy remote administration tools like Microsoft SCCM (Configuration Manager) or Ivanti Neurons to push updates and manage endpoints. These agents frequently establish outbound connections to central management servers using specific ports and protocols that may match the ValleyRAT network signature (e.g., specific HTTP/HTTPS user-agent strings or destination IP ranges).
  • Filter/Exclusion: Create a whitelist exclusion based on the Process Name of the legitimate agent (e.g., ccmexec.exe for SCCM) and restrict the rule to exclude traffic originating from known management server subnets (e.g., 10.20.x.x).

• Scenario: Scheduled Backup or Sync Jobs

  • Context: Automated backup solutions such as Veeam Agent, Acronis Cyber Protect, or cloud sync tools like OneDrive for Business often run scheduled jobs during off-hours. These processes may initiate network connections to storage endpoints that share IP addresses or domain names with the ValleyRAT IOCs, triggering alerts when the job executes its initial handshake.
  • Filter/Exclusion: Implement a time-based filter to suppress alerts between 02:00 and 06:00 local time for processes matching known backup executables (e.g., VeeamAgent.exe, OneDrive.exe). Alternatively, exclude specific destination IP addresses belonging to the organization’s internal cloud storage gateways.

• Scenario: Third-Party Security Scanners

  • Context: Endpoint Detection and Response (EDR) platforms like CrowdStrike Falcon, SentinelOne, or Carbon Black perform