ThreatFox: VShell IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity involving eight specific indicators of compromise (IOCs) linked to the VShell remote access tool, which is frequently leveraged by threat actors for command and control or lateral movement. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly detect early-stage intrusions where attackers utilize VShell to establish persistent footholds within the enterprise network before initiating broader attack campaigns.

IOC Summary

Malware Family: VShell Total IOCs: 8 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`192[.]25[.]102[.]246:8089`	botnet_cc	2026-09-01	100%
ip:port	`104[.]244[.]91[.]64:8084`	botnet_cc	2026-09-01	100%
ip:port	`204[.]194[.]53[.]9:9443`	botnet_cc	2026-09-01	100%
ip:port	`192[.]144[.]168[.]105:9999`	botnet_cc	2026-09-01	100%
ip:port	`43[.]254[.]166[.]35:39001`	botnet_cc	2026-09-01	100%
ip:port	`146[.]56[.]239[.]16:8084`	botnet_cc	2026-09-01	100%
ip:port	`1[.]13[.]179[.]86:9876`	botnet_cc	2026-09-01	100%
ip:port	`101[.]43[.]118[.]48:8888`	botnet_cc	2026-09-01	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["192.25.102.246", "146.56.239.16", "1.13.179.86", "104.244.91.64", "192.144.168.105", "204.194.53.9", "43.254.166.35", "101.43.118.48"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["192.25.102.246", "146.56.239.16", "1.13.179.86", "104.244.91.64", "192.144.168.105", "204.194.53.9", "43.254.166.35", "101.43.118.48"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — VShell

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: VShell IOCs detection rule in an enterprise environment:

Scenario: Endpoint Protection Scanning of Quarantine Archives
- Context: Enterprise EDR solutions (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) often scan archived threat intelligence feeds or quarantine logs stored on the file system. If these archives contain VShell IOC signatures (hashes or URLs), the scanner may trigger a match during routine database updates.
- Filter/Exclusion: Exclude processes belonging to known security agents from triggering this rule. Specifically, add an exclusion for process names C-Host.exe (CrowdStrike) and MsMpEng.exe (Defender) when the source file path contains \Quarantine\ or \ThreatIntelligence\.
Scenario: Scheduled Threat Intelligence Ingestion Job
- Context: A nightly scheduled task (e.g., running via Windows Task Scheduler or Ansible Tower) pulls raw threat feeds from a SIEM or external feed provider. If the ingestion script processes VShell data to update local blocklists, it will naturally generate IOCs that match the rule’s logic.
- Filter/Exclusion: Create an exclusion based on the user context and job name. Filter out events where the User is a dedicated service account (e.g., svc-threat-ingest) AND the Process Name matches known automation tools like python.exe, powershell.exe, or specific Ansible runner processes executing during maintenance windows (02:00–04:00).
Scenario: Admin Manual Review of VShell Reports
- Context: Security analysts or SOC managers frequently download and open PDF/CSV reports generated by the ThreatFox platform itself. When an analyst opens a report containing embedded VShell IOCs in