Windows Modify Registry ValleyRAT C2 Config

The following analytic detects modifications to theregistry related to ValleyRAT C2 configuration. Specifically, it monitors changes in registry keys where ValleyRAT saves the IP address and port information of its command-and-control (C2) server. This activity is a key indicator of ValleyRAT attempting to establish persistent communication with its C2 infrastructure. By identifying these unauthorized registry modifications, security analysts can quickly detect malicious configurations and investigate the associated threats. Early detection of these changes helps prevent further exploitation and limits the malware’s ability to exfiltrate data or control infected systems.

ATT&CK coverage

Persistence

T1112Modify RegistryAlso under Defense Impairment.198 detections cover this technique

Detection requirements

Log source category: sysmon_eventid_13

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.

Sign in to read it Create an account

Detection catalogue

ATT&CK coverage

Detection requirements

Detection logic