ValleyRAT Suspicious Watchdog UserAccountBroker Activity

Tim Peck@timpeck

•updated Feb 4, 2026•2•0•45

Detects the suspicious spawning of UserAccountBroker.exe by explorer.exe, which is then observed making an outbound network connection. This behavior is characteristic of a watchdog mechanism used by the ValleyRAT malware to maintain persistence and C2 communication.