ThreatFox: VShell IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets known indicators of compromise for VShell, a tool frequently used by adversaries to establish persistent backdoor access and execute commands on compromised hosts. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify stealthy footholds before they are leveraged for lateral movement or data exfiltration.

IOC Summary

Malware Family: VShell Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`124[.]221[.]92[.]3:9999`	botnet_cc	2026-09-16	100%
ip:port	`47[.]239[.]223[.]39:8123`	botnet_cc	2026-09-16	100%
ip:port	`114[.]215[.]190[.]164:8085`	botnet_cc	2026-09-16	100%
ip:port	`123[.]60[.]142[.]164:8084`	botnet_cc	2026-09-16	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["47.239.223.39", "123.60.142.164", "124.221.92.3", "114.215.190.164"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["47.239.223.39", "123.60.142.164", "124.221.92.3", "114.215.190.164"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — VShell

False Positive Guidance

Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., Jenkins or GitHub Actions) to deploy a custom Java-based microservice that bundles the VShell client for internal service-to-service communication. The deployment script executes the VShell binary from a temporary directory (/tmp or C:\Windows\Temp) to establish a connection to the backend, triggering the IOC match for the executable path or hash.
- Filter/Exclusion: Exclude processes where the parent process is a known CI/CD agent (e.g., java.exe with jenkins or github-actions in the command line) and the VShell executable resides in a standard build artifact directory (e.g., *.jar extraction paths or node_modules) rather than a user-writable temp folder.
Scenario: An IT administrator performs a routine vulnerability scan using a tool like Nessus or Qualys that includes a custom plugin to test for VShell backdoors. The scanner spawns a child process to execute the VShell client against a target host for connectivity verification, creating a short-lived process that matches the IOC.
- Filter/Exclusion: Exclude events where the parent process is a known vulnerability scanner (e.g., nessus.exe, qualys-agent.exe) and the VShell process lifetime is less than 30 seconds, indicating a transient test rather than a persistent backdoor.
Scenario: A security team conducts a red team engagement or purple team exercise where they intentionally deploy VShell on a non-production test server to validate detection coverage. The deployment is documented but not yet whitelisted in the SIEM, causing the rule to fire during the exercise.
- Filter/Exclusion: Implement a time-based exclusion or tag-based filter for known red team engagement windows (e.g., exclude if the event occurs within a defined red_team_window timestamp range