Detections
ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions
Public event hunting query
spl
· Evidence-linked query artifact; local execution not performed.
index=* ("ValleyRAT" OR "Backdoor") | stats count by host, user, process_name