ThreatFox: VShell IOCs

Hunt Hypothesis

This detection identifies adversary activity involving specific indicators of compromise (IOCs) linked to the VShell command and control infrastructure, which is often utilized by threat actors to establish persistent access or exfiltrate data. Proactively hunting for these IOCs within Azure Sentinel allows the SOC team to rapidly isolate potential compromises before adversaries can leverage their established foothold to execute lateral movement or data theft operations.

IOC Summary

Malware Family: VShell Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["118.195.158.209", "110.42.211.101"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["118.195.158.209", "110.42.211.101"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — VShell

False Positive Guidance

Here are the false positive scenarios and corresponding exclusions for the ThreatFox: VShell IOCs detection rule:

• Scenario: Scheduled Backup Jobs utilizing VShell

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize VShell agents on file servers to perform nightly incremental backups. These jobs trigger network connections and process execution that match the VShell IOC signatures.
  • Filter/Exclusion: Exclude alerts where the source process is vshelld.exe (or VeeamTransportService) running under a dedicated service account (e.g., DOMAIN\BackupSvc) during the defined maintenance window (e.g., 01:00–05:00 UTC).

• Scenario: Admin Remote Management via VShell Console

  • Context: System administrators frequently log into the VShell management console to perform configuration changes or troubleshoot storage arrays. This activity generates IOCs that mimic potential compromise indicators, particularly when connecting from known admin workstations (e.g., AD-Admin-01).
  • Filter/Exclusion: Suppress alerts originating from specific “Jump Box” IP ranges or where the user context is a member of the Domain Admins group performing interactive logins rather than automated service accounts.

• Scenario: Patch Management and Software Updates

  • Context: Automated patching tools (e.g., SCCM, WSUS) may trigger VShell components to update firmware or apply security patches on storage nodes. This results in the execution of VShell binaries that match the detection logic for new IOCs.
  • Filter/Exclusion: Create a rule exclusion for events occurring immediately following a “Patch Tuesday” cycle, specifically filtering out processes with a file hash matching the known good version of VShell.exe deployed by the patch management system