ThreatFox: VShell IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity involving specific Indicators of Compromise (IOCs) linked to the VShell threat actor, which often utilizes these signatures during initial access and lateral movement phases. Proactively hunting for these IOCs within Azure Sentinel is critical to rapidly detect early-stage intrusions by a high-severity threat known for sophisticated command-and-control mechanisms, thereby reducing dwell time before potential data exfiltration occurs.

IOC Summary

Malware Family: VShell Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`38[.]55[.]200[.]183:8443`	botnet_cc	2026-08-30	100%
ip:port	`47[.]113[.]179[.]196:8085`	botnet_cc	2026-08-30	100%
ip:port	`123[.]254[.]106[.]168:8084`	botnet_cc	2026-08-30	100%
ip:port	`118[.]99[.]55[.]153:8083`	botnet_cc	2026-08-30	100%
ip:port	`43[.]136[.]76[.]42:8081`	botnet_cc	2026-08-30	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["123.254.106.168", "47.113.179.196", "43.136.76.42", "118.99.55.153", "38.55.200.183"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["123.254.106.168", "47.113.179.196", "43.136.76.42", "118.99.55.153", "38.55.200.183"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — VShell

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: VShell IOCs detection rule, along with targeted filtering strategies to reduce noise in an enterprise environment:

Scenario: Automated Patch Management Deployment
- Context: The organization utilizes Microsoft Endpoint Configuration Manager (SCCM) or Intune to push security updates. During the nightly maintenance window, the patching engine downloads and executes VShell-related binaries from trusted repositories, triggering IOCs that mimic initial infection patterns.
- Filter/Exclusion: Create a rule exclusion based on the Process Name (ccmsetup.exe or intuneagent.exe) combined with a Time Window (e.g., 02:00–04:00 UTC). Additionally, whitelist the specific Source IP ranges of the patch distribution points.
Scenario: Scheduled Backup and Archiving Jobs
- Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault frequently scan and archive data stored in VShell-managed repositories. The backup agents initiate I/O operations that match the detection logic’s signature for VShell file access patterns, generating alerts during peak backup cycles.
- Filter/Exclusion: Implement a filter excluding events where the Parent Process is vbr.exe (Veeam) or commvaultagent.exe. Furthermore, exclude specific File Paths known to be part of the backup repository (e.g., \\BackupServer\VShell_Archive\*).
Scenario: Third-Party Antivirus Scanning
- Context: The endpoint protection suite, such as CrowdStrike Falcon, SentinelOne, or Symantec Endpoint Protection, performs on-access scanning of the VShell application directory. When these agents open VShell executables for signature verification,