This rule detects the presence of VShell, a lightweight remote access tool often used by adversaries to establish covert command-and-control channels or maintain persistence within compromised Azure environments. Proactively hunting for these IOCs allows the SOC team to identify stealthy backdoors that may bypass standard monitoring, ensuring rapid containment of potential lateral movement or data exfiltration attempts.
Malware Family: VShell Total IOCs: 11 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 47[.]74[.]43[.]122:8084 | botnet_cc | 2026-09-06 | 100% |
| ip:port | 156[.]251[.]16[.]126:8084 | botnet_cc | 2026-09-06 | 100% |
| ip:port | 38[.]46[.]15[.]205:4141 | botnet_cc | 2026-09-06 | 100% |
| ip:port | 38[.]46[.]15[.]203:4141 | botnet_cc | 2026-09-06 | 100% |
| ip:port | 43[.]136[.]40[.]48:8088 | botnet_cc | 2026-09-06 | 100% |
| ip:port | 38[.]46[.]15[.]202:4141 | botnet_cc | 2026-09-06 | 100% |
| ip:port | 38[.]46[.]15[.]206:4141 | botnet_cc | 2026-09-06 | 100% |
| ip:port | 8[.]216[.]20[.]25:4433 | botnet_cc | 2026-09-06 | 100% |
| ip:port | 192[.]144[.]219[.]65:8099 | botnet_cc | 2026-09-06 | 100% |
| ip:port | 38[.]76[.]202[.]152:9999 | botnet_cc | 2026-09-06 | 100% |
| ip:port | 47[.]105[.]100[.]60:8086 | botnet_cc | 2026-09-06 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["38.46.15.202", "38.46.15.205", "156.251.16.126", "38.46.15.206", "47.105.100.60", "192.144.219.65", "43.136.40.48", "38.46.15.203", "47.74.43.122", "8.216.20.25", "38.76.202.152"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["38.46.15.202", "38.46.15.205", "156.251.16.126", "38.46.15.206", "47.105.100.60", "192.144.219.65", "43.136.40.48", "38.46.15.203", "47.74.43.122", "8.216.20.25", "38.76.202.152"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps team uses a custom PowerShell wrapper script to automate the deployment of internal microservices, which includes a step to download and execute a specific version of vshell.exe (or its components) from the internal artifact repository for testing purposes.
C:\Tools\Deploy\* or the parent process is powershell.exe initiated by a known service account (e.g., svc-deployer) and the file hash matches the known-good internal build.Scenario: An IT administrator performs a manual vulnerability assessment using a portable version of VShell to test remote access capabilities on a non-production server, running the tool from a temporary directory like C:\Users\admin\Downloads\.
IT-Security-Team group and the process path contains Downloads or Temp, provided the target server is tagged as Non-Prod in the asset inventory.Scenario: A scheduled maintenance job runs a backup verification script that temporarily invokes VShell’s vshell-cli to validate connectivity to remote nodes before executing the full backup routine.
schtasks.exe or taskeng.exe and the command line arguments contain specific flags like --verify or --check, and the execution time falls within the defined maintenance window (e.g., 02:00–04:00 UTC).Scenario: A developer uses VShell as a lightweight SSH alternative for quick debugging sessions on a development VM, launching it directly from the IDE’s integrated terminal or a local shortcut.
Dev-VM and the