URLhaus: ValleyRAT Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity where threat actors leverage known ValleyRAT command-and-control infrastructure to establish persistent access via specific malicious URLs. The SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly identify and isolate compromised endpoints before the RAT facilitates lateral movement or data exfiltration within the environment.

IOC Summary

Threat: ValleyRAT Total URLs: 10 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ValleyRAT
let malicious_domains = dynamic(["tdfhdser-1433552157.cos.ap-hongkong.myqcloud.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["tdfhdser-1433552157.cos.ap-hongkong.myqcloud.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are the documented false positive scenarios and corresponding filters for the URLhaus: ValleyRAT Malicious URLs detection rule:

• Scenario: Automated Security Scanning by EDR Agents

  • Context: Enterprise Endpoint Detection and Response (EDR) solutions, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, periodically perform outbound connectivity checks to their cloud management consoles. These agents often query known security intelligence feeds that may overlap with the ValleyRAT URL list, triggering a hit when the agent polls the URLhaus API or its own update servers.
  • Filter/Exclusion: Exclude traffic originating from specific EDR service accounts (e.g., svc-crowdstrike or mdef-agent) and restrict the rule to exclude destination IP ranges belonging to the primary security vendor’s cloud infrastructure (e.g., *.crowdstrike.com, *.microsoftonline.com).

• Scenario: Scheduled Backup and Synchronization Jobs

  • Context: Legacy backup software like Veeam Backup & Replication or Rubrik often utilizes scheduled tasks to sync metadata with cloud repositories. If the organization’s backup repository is hosted on a platform that shares infrastructure with ValleyRAT indicators, or if the backup agent queries a shared CDN for manifest files, it may trigger this rule during its nightly 2:00 AM maintenance window.
  • Filter/Exclusion: Create an exclusion based on the source process name (e.g., Veeam.Backup.Service.exe) and time-of-day logic, filtering out alerts generated between 01:30 and 04:30 UTC for these specific backup service accounts.

• Scenario: Admin-Driven Patch Management Deployments

  • Context: During major patch cycles, IT administrators use tools like Microsoft Endpoint Configuration Manager (MECM/SCCM) or **