This hunt targets the presence of VShell, a cross-platform reverse shell tool frequently used by adversaries to establish persistent, low-noise command-and-control channels that bypass standard firewall egress rules. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised endpoints before attackers leverage this covert access to execute further lateral movement or data exfiltration within the environment.
Malware Family: VShell Total IOCs: 55 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 154[.]91[.]59[.]108:8084 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 154[.]91[.]59[.]106:8084 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 154[.]91[.]57[.]119:8084 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 154[.]91[.]60[.]121:8084 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 154[.]91[.]60[.]126:8084 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 154[.]91[.]60[.]125:8084 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 154[.]91[.]61[.]98:8084 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 154[.]91[.]57[.]114:8084 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 154[.]91[.]57[.]125:8084 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 154[.]91[.]57[.]112:8084 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 154[.]91[.]57[.]124:8084 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 154[.]91[.]57[.]122:8084 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 154[.]91[.]57[.]123:8084 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 154[.]91[.]61[.]106:8084 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 154[.]91[.]57[.]99:8084 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 154[.]91[.]57[.]121:8084 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 154[.]91[.]61[.]108:8084 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 154[.]91[.]61[.]112:8084 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 154[.]91[.]61[.]101:8084 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 154[.]91[.]61[.]102:8084 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 154[.]91[.]61[.]107:8084 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 154[.]91[.]61[.]105:8084 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 154[.]91[.]61[.]103:8084 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 154[.]91[.]61[.]111:8084 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 154[.]91[.]61[.]100:8084 | botnet_cc | 2026-09-05 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["154.91.62.115", "154.91.58.101", "154.91.57.123", "154.91.58.100", "154.91.58.98", "154.91.61.98", "154.91.57.125", "154.91.61.118", "154.91.57.99", "154.91.61.111", "154.91.58.117", "154.91.58.108", "154.91.61.120", "154.91.60.126", "154.91.61.125", "154.91.58.115", "154.91.61.100", "154.91.61.107", "154.91.61.103", "154.91.61.124", "154.91.62.104", "154.91.61.102", "154.91.57.119", "154.91.58.120", "154.91.57.114", "154.91.57.121", "154.91.60.125", "154.91.61.116", "154.91.62.105", "154.91.60.121", "154.91.61.117", "154.91.61.101", "154.91.61.108", "154.91.57.122", "154.91.62.102", "154.91.61.115", "154.91.59.108", "154.91.58.104", "154.91.61.123", "154.91.57.112", "154.91.62.112", "154.91.62.111", "154.91.61.106", "154.91.61.119", "154.91.61.112", "154.91.61.114", "154.91.61.121", "154.91.62.113", "154.91.61.105", "154.91.62.100"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["154.91.62.115", "154.91.58.101", "154.91.57.123", "154.91.58.100", "154.91.58.98", "154.91.61.98", "154.91.57.125", "154.91.61.118", "154.91.57.99", "154.91.61.111", "154.91.58.117", "154.91.58.108", "154.91.61.120", "154.91.60.126", "154.91.61.125", "154.91.58.115", "154.91.61.100", "154.91.61.107", "154.91.61.103", "154.91.61.124", "154.91.62.104", "154.91.61.102", "154.91.57.119", "154.91.58.120", "154.91.57.114", "154.91.57.121", "154.91.60.125", "154.91.61.116", "154.91.62.105", "154.91.60.121", "154.91.61.117", "154.91.61.101", "154.91.61.108", "154.91.57.122", "154.91.62.102", "154.91.61.115", "154.91.59.108", "154.91.58.104", "154.91.61.123", "154.91.57.112", "154.91.62.112", "154.91.62.111", "154.91.61.106", "154.91.61.119", "154.91.61.112", "154.91.61.114", "154.91.61.121", "154.91.62.113", "154.91.61.105", "154.91.62.100"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses a version-controlled repository to store and distribute a custom, lightweight shell script (e.g., vshell.sh) for internal automation tasks, where the script’s hash or filename matches one of the 55 IOCs.
C:\src\, C:\projects\) or files with extensions like .sh, .ps1, or .py that are owned by service accounts or developer groups, provided they are not executing from executable directories like C:\Windows\System32.Scenario: An IT administrator performs a routine patching or cleanup task using a third-party utility (e.g., a specific version of 7-Zip or a custom .exe tool) that shares a known hash with a VShell IOC due to similar compilation settings or code reuse.
C:\Program Files\ or C:\Program Files (x86)\ to avoid broadening the scope to user-writable directories.Scenario: A scheduled task runs a legacy backup or log rotation script that was compiled with an older version of a compiler, resulting in a binary hash that coincidentally matches a VShell IOC, particularly if the script is stored in a shared network drive mounted locally.
\\fileserver\backups\) or specific scheduled task execution paths (e.g., C:\ProgramData\CorpTasks\), and verify the parent process is a known scheduler (e.g., schtasks.exe or Task Scheduler service