---
title: Potential ValleyRAT Fake Installer Payload Retrieval
id: 8b8e2d1f-9a4c-4d5f-b6e8-1c2d3e4f5a6b
description: Detects processes downloading payloads from known ValleyRAT C2 infrastructure or suspicious Aliyun OSS buckets.
status: experimental
author: Security Arsenal
date: 2026/07/31
tags:
    - attack.command_and_control
    - attack.t1102
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        DestinationHostname|contains:
            - 'aliyuncs.com'
        DestinationPort: 80
    filter_legit:
        Image|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\edge.exe'
            - '\msedge.exe'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate administrative tools accessing cloud storage
level: high
---
title: Suspicious Driver Load indicative of BYOVD (SilverFox)
id: 9c9f3e2g-0b5d-5e6g-c7f9-2d3e4f5g6h7i
description: Detects the loading of known vulnerable drivers often used in BYOVD attacks like Pool Party to disable security tools.
status: experimental
author: Security Arsenal
date: 2026/07/31
tags:
    - attack.privilege_escalation
    - attack.t1068
logsource:
    category: driver_load
    product: windows
detection:
    selection:
        Loaded|contains:
            - 'RTCore64.sys'
            - 'mhyprot2.sys'
            - 'DBUtil_2_3.sys'
            - 'gdrv.sys'
    condition: selection
falsepositives:
    - Legitimate gaming software (e.g., MSI Afterburner)
level: critical
---
title: ValleyRAT Process Injection via Donut Loader
id: 1a2b3c4d-5e6f-7g8h-9i0j-1k2l3m4n5o6p
description: Detects characteristics of shellcode injection using Donut loader, commonly observed in ValleyRAT campaigns.
status: experimental
author: Security Arsenal
date: 2026/07/31
tags:
    - attack.defense_evasion
    - attack.t1055
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'donut' # Rare in cmdline, often implies loader execution
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\rundll32.exe'
    injection_api:
        SourceImage|endswith:
            - '\rundll32.exe'
        TargetImage|endswith:
            - '\svchost.exe'
            - '\explorer.exe'
            - '\notepad.exe'
    condition: selection or injection_api
falsepositives:
    - Rare administrative automation
level: high


kql
// Hunt for ValleyRAT network indicators and process activity
let IOCs = dynamic(["frehf.oss-cn-hongkong.aliyuncs.com", "154.92.16.22"]);
let Hashes = dynamic(["e8be03f19ada1f5cec74b143e21d4939e781671d", "65168c8dd93b16d3b77092fb70c0fa6fba4dffcc", "eca7ed7b699835fadc2c2997a2845864e02b8dfe"]);
// Network Connections
DeviceNetworkEvents
| where RemoteUrl has_any (IOCs) or RemoteIP has_any (IOCs)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, InitiatingProcessCommandLine
| union (
    DeviceProcessEvents
    | where SHA1 has_any (Hashes)
    | project Timestamp, DeviceName, AccountName, FolderPath, SHA1, ProcessCommandLine
)


powershell
# ValleyRAT/SilverFox IOC Hunt Script
# Requires Administrator privileges

Write-Host "[*] Starting hunt for SilverFox/ValleyRAT artifacts..." -ForegroundColor Cyan

$IOC_Hashes = @(
    "e8be03f19ada1f5cec74b143e21d4939e781671d",
    "65168c8dd93b16d3b77092fb70c0fa6fba4dffcc",
    "eca7ed7b699835fadc2c2997a2845864e02b8dfe"
)

$IOC_Domains = @("frehf.oss-cn-hongkong.aliyuncs.com", "154.92.16.22")

# Check for File Hashes
Write-Host "[*] Scanning for known malicious file hashes..." -ForegroundColor Yellow
foreach ($hash in $IOC_Hashes) {
    # Using Get-ChildItem and Get-FileHash is slow on entire drive; targeting common temp/appdata paths
    $paths = @("$env:TEMP", "$env:LOCALAPPDATA", "$env:APPDATA")
    foreach ($path in $paths) {
        if (Test-Path $path) {
            Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | Get-FileHash -Algorithm SHA1 -ErrorAction SilentlyContinue | Where-Object { $_.Hash -eq $hash } | ForEach-Object {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.Path)" -ForegroundColor Red
            }
        }
    }
}

# Check DNS Cache for C2 Domains
Write-Host "[*] Checking DNS Cache for C2 domains..." -ForegroundColor Yellow
Get-DnsClientCache | Where-Object { $IOC_Domains -contains $_.Data } | ForEach-Object {
    Write-Host "[!] SUSPICIOUS DNS ENTRY: $($_.Entry) -> $($_.Data)" -ForegroundColor Red
}

# Check for Suspicious Drivers (BYOVD)
Write-Host "[*] Checking for loaded vulnerable drivers..." -ForegroundColor Yellow
$suspiciousDrivers = @("RTCore64.sys", "mhyprot2.sys", "DBUtil_2_3.sys", "gdrv.sys")
Get-WindowsDriver -Online -All | Where-Object { $suspiciousDrivers -contains $_.OriginalFileName } | ForEach-Object {
    Write-Host "[!] SUSPICIOUS DRIVER LOADED: $($_.OriginalFileName) - Provider: $($_.ProviderName)" -ForegroundColor Red
}

Write-Host "[*] Hunt complete." -ForegroundColor Green


# Response Priorities