ThreatFox: VShell IOCs

Hunt Hypothesis

This detection identifies adversary activity involving known VShell indicators of compromise (IOCs) that signal potential command-and-control or lateral movement within the network. A proactive hunt is essential in Azure Sentinel to rapidly isolate and investigate these specific threats before they escalate into broader security incidents, given their high severity classification.

IOC Summary

Malware Family: VShell Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["154.91.180.246"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["154.91.180.246"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — VShell

False Positive Guidance

• Scheduled Backup Job Execution: Enterprise backup solutions like Veeam or Rubrik often initiate automated scripts to scan and archive data within shared network drives where VShell agents are installed. These jobs may trigger file I/O events that match the VShell IOC signatures during their nightly maintenance windows (e.g., 02:00–04:00).

  • Suggested Filter: Exclude alerts generated by service accounts named svc_backup or process names containing Veeam/Rubrik running on designated backup servers between 01:00 and 06:00 local time.

• Group Policy Object (GPO) Deployment: When IT administrators push new security configurations via Microsoft Active Directory Group Policy, the system may deploy VShell-related registry keys or configuration files to endpoints. This administrative action can mimic the file creation or modification patterns associated with a potential threat.

  • Suggested Filter: Create an exclusion for events where the User field matches DOMAIN\AdminGroup and the ProcessName is gpupdate.exe or csrss.exe, specifically during known maintenance windows (e.g., Tuesday/Thursday mornings).

• Software Patching via Configuration Management: Tools like Microsoft SCCM or Ansible Tower frequently execute patching cycles that update VShell components. During these updates, the configuration management agent writes logs and modifies binaries in a way that aligns with the detection logic for VShell IOCs.

  • Suggested Filter: Suppress alerts where the initiating process is ccmsetup.exe (SCCM) or ansible-runner, and the event source indicates a “Software Update” action rather than an unattended user login.

• Endpoint Security Agent Self-Maintenance: The primary endpoint protection suite, such as CrowdStrike Falcon or SentinelOne, often performs self-healing routines that interact with