ThreatFox: VShell IOCs | SOC Hunt Feed

Hunt Hypothesis

This rule detects adversaries utilizing VShell malware to establish persistent command-and-control (C2) communications for long-term network access and data exfiltration. Proactive hunting is essential in Azure Sentinel because VShell’s stealthy C2 patterns often evade standard signature-based defenses, requiring behavioral analysis to identify early-stage compromises before lateral movement occurs.

IOC Summary

Malware Family: VShell Total IOCs: 9 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`111[.]229[.]216[.]164:7963`	botnet_cc	2026-08-15	100%
ip:port	`106[.]15[.]104[.]224:1234`	botnet_cc	2026-08-15	100%
ip:port	`204[.]194[.]53[.]9:80`	botnet_cc	2026-08-15	100%
ip:port	`204[.]194[.]53[.]9:8443`	botnet_cc	2026-08-15	100%
ip:port	`207[.]148[.]126[.]156:8084`	botnet_cc	2026-08-15	100%
ip:port	`47[.]95[.]222[.]141:10443`	botnet_cc	2026-08-15	100%
ip:port	`39[.]96[.]3[.]65:8888`	botnet_cc	2026-08-15	100%
ip:port	`47[.]250[.]190[.]129:5001`	botnet_cc	2026-08-14	100%
ip:port	`68[.]64[.]181[.]23:19999`	botnet_cc	2026-08-14	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["106.15.104.224", "47.95.222.141", "47.250.190.129", "39.96.3.65", "207.148.126.156", "111.229.216.164", "68.64.181.23", "204.194.53.9"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["106.15.104.224", "47.95.222.141", "47.250.190.129", "39.96.3.65", "207.148.126.156", "111.229.216.164", "68.64.181.23", "204.194.53.9"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — VShell

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: VShell IOCs rule, along with suggested filters or exclusions tailored for an enterprise environment:

Scenario: Admin Deployment of Remote Management Tools
- Context: System administrators frequently deploy remote management suites (e.g., BeyondTrust, ManageEngine Desktop Central, or Microsoft Endpoint Configuration Manager) which establish persistent, long-lived HTTP/HTTPS connections to their central console for policy updates and telemetry. These tools often mimic the C2 heartbeat patterns of VShell malware by maintaining constant bidirectional communication with known infrastructure IPs.
- Filter/Exclusion: Create an exclusion rule that ignores alerts where the source process is a known management agent (e.g., BeyondTrustAgent.exe, DesKtopCentralClient.exe) communicating with whitelisted internal IP ranges or specific FQDNs associated with the MDM console.
Scenario: Scheduled Backup and Cloud Sync Operations
- Context: Enterprise backup solutions like Veeam, Rubrik, or cloud sync tools such as OneDrive for Business and Box run scheduled jobs during business hours that initiate persistent connections to external storage endpoints. These jobs often utilize similar port ranges (80/443) and connection durations that trigger the “persistent communication” logic of the VShell detection, especially when syncing large datasets.
- Filter/Exclusion: Implement a filter based on process path and scheduled task names. Exclude alerts where the source process resides in standard backup directories (e.g., C:\Program Files\Veeam\...) or matches specific Scheduled Task IDs (e.g., VeeamBackupSync, OneDriveSyncJob) communicating with known cloud storage domains.
Scenario: Legitimate DevOps CI/CD Pipeline Execution
- Context: In development environments, build