ThreatFox: VShell IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies the covert command-and-control communications established by VShell malware to maintain persistence within a compromised environment. Proactively hunting for these indicators in Azure Sentinel is critical because early identification of this stealthy traffic can prevent lateral movement and data exfiltration before the adversary fully establishes its foothold.

IOC Summary

Malware Family: VShell Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`8[.]145[.]59[.]5:11112`	botnet_cc	2026-08-28	100%
ip:port	`89[.]34[.]227[.]96:8088`	botnet_cc	2026-08-28	100%
ip:port	`47[.]94[.]194[.]175:15000`	botnet_cc	2026-08-28	100%
ip:port	`104[.]168[.]94[.]108:38006`	botnet_cc	2026-08-28	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["8.145.59.5", "104.168.94.108", "89.34.227.96", "47.94.194.175"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["8.145.59.5", "104.168.94.108", "89.34.227.96", "47.94.194.175"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — VShell

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: VShell IOCs rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Automated Patch Deployment via SCCM/Intune
- Context: During scheduled maintenance windows, System Center Configuration Manager (SCCM) or Microsoft Intune agents initiate background communication to download patches. The VShell detection logic may misinterpret the high-volume, persistent TCP connections from these agents as the “covert communication” characteristic of a compromised shell.
- Filter/Exclusion: Exclude traffic originating from specific service accounts (e.g., S-1-5-21...-500 or NT SERVICE\ccmExec) and restrict the rule to exclude ports commonly used by patching services, such as TCP 8531 (SCCM) and TCP 443 traffic destined for known Microsoft update endpoints.
Scenario: Scheduled Backup Jobs Using Veeam or Commvault
- Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault often establish long-lived, encrypted sessions to transfer data to offsite repositories. The “covert communication” signature of these steady-state data streams can mimic the beaconing behavior of VShell malware, especially if the backup agent runs as a system-level process with broad network permissions.
- Filter/Exclusion: Create an exclusion for processes named VeeamTransportService.exe or commvault.dat. Additionally, filter out traffic where the destination IP belongs to the internal backup infrastructure subnet (e.g., 10.x.x.x) rather than external public IPs, as VShell typically communicates with external C2 servers.
Scenario: Endpoint Detection and Response (EDR) Telemetry Uploads
- Context: Modern EDR platforms such as CrowdStrike Falcon