ThreatFox: VShell IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity involving six specific indicators of compromise (IOCs) linked to the VShell remote access tool, which is frequently leveraged by threat actors for persistent command and control or lateral movement. A proactive hunt in Azure Sentinel is essential because early identification of these IOCs allows the SOC team to isolate compromised endpoints before attackers can establish deep footholds within the network infrastructure.

IOC Summary

Malware Family: VShell Total IOCs: 6 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`8[.]135[.]18[.]143:8085`	botnet_cc	2026-08-29	100%
ip:port	`165[.]154[.]226[.]87:8084`	botnet_cc	2026-08-29	100%
ip:port	`106[.]53[.]122[.]24:8888`	botnet_cc	2026-08-29	100%
ip:port	`8[.]145[.]59[.]5:11112`	botnet_cc	2026-08-28	100%
ip:port	`89[.]34[.]227[.]96:8088`	botnet_cc	2026-08-28	100%
ip:port	`47[.]94[.]194[.]175:15000`	botnet_cc	2026-08-28	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["89.34.227.96", "106.53.122.24", "8.135.18.143", "8.145.59.5", "47.94.194.175", "165.154.226.87"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["89.34.227.96", "106.53.122.24", "8.135.18.143", "8.145.59.5", "47.94.194.175", "165.154.226.87"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — VShell

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: VShell IOCs detection rule in an enterprise environment:

Scenario: Security Operations Center (SOC) analysts or threat intelligence teams manually importing new indicators into a SIEM platform like Splunk Enterprise Security or Microsoft Sentinel.
- Context: When analysts run the “Import Threat Intelligence” job to onboard VShell IOCs for correlation, the ingestion process triggers network traffic and file hash events matching the rule’s logic.
- Filter/Exclusion: Exclude events where the Source Host is a known SIEM management node (e.g., splunk-ingest-01) or where the Process Name matches the ingestion tool (e.g., siem_import_service.exe).
Scenario: Automated vulnerability scanning performed by Tenable Nessus or Qualys agents during scheduled maintenance windows.
- Context: During nightly scans, these tools often query external threat feeds or download signature updates that include VShell IOCs to cross-reference against the asset inventory, generating legitimate network connections and file accesses.
- Filter/Exclusion: Create a filter for events occurring within the defined maintenance window (e.g., 02:00–04:00 UTC) where the Initiating Process is identified as nessus.exe, qualyspc.exe, or their associated service accounts.
Scenario: Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon or Carbon Black, performing scheduled policy updates and IOC synchronization.
- Context: The EDR console pushes updated detection policies containing VShell IOCs to all endpoints; the local agent service (FalconSensor.exe or cbengine.exe) initiates a download and validation task that matches the rule’s signature.