ValleyRAT Silver Fox Phantom Persistence Module Artifact Detection

Ankit Mehta@Secvyn

•updated Jun 30, 2026•2•0•3

Detects artifacts related to the ValleyRAT malware family, specifically identifying markers such as 'Phantom Persistence Module', 'RegisterApplicationRestart', and specific 'RSL_' strings within process command lines, image paths, or module loads using Windows Event Logs and Sysmon data.