This hypothesis targets the presence of VShell, a lightweight web shell that adversaries deploy to establish persistent access and execute commands within Azure environments. Proactively hunting for these IOCs allows the SOC to identify compromised instances or containers before the web shell is leveraged for lateral movement or privilege escalation.
Malware Family: VShell Total IOCs: 17 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 154[.]91[.]57[.]110:8094 | botnet_cc | 2026-09-07 | 100% |
| ip:port | 154[.]91[.]57[.]112:8094 | botnet_cc | 2026-09-07 | 100% |
| ip:port | 154[.]91[.]57[.]116:8094 | botnet_cc | 2026-09-07 | 100% |
| ip:port | 154[.]91[.]57[.]111:8094 | botnet_cc | 2026-09-07 | 100% |
| ip:port | 154[.]91[.]57[.]119:8094 | botnet_cc | 2026-09-07 | 100% |
| ip:port | 154[.]91[.]57[.]118:8094 | botnet_cc | 2026-09-07 | 100% |
| ip:port | 154[.]91[.]57[.]124:8094 | botnet_cc | 2026-09-07 | 100% |
| ip:port | 154[.]91[.]57[.]125:8094 | botnet_cc | 2026-09-07 | 100% |
| ip:port | 154[.]91[.]57[.]122:8094 | botnet_cc | 2026-09-07 | 100% |
| ip:port | 154[.]91[.]57[.]120:8094 | botnet_cc | 2026-09-07 | 100% |
| ip:port | 154[.]91[.]58[.]122:8094 | botnet_cc | 2026-09-07 | 100% |
| ip:port | 154[.]91[.]58[.]116:8094 | botnet_cc | 2026-09-07 | 100% |
| ip:port | 154[.]91[.]58[.]98:8094 | botnet_cc | 2026-09-07 | 100% |
| ip:port | 154[.]91[.]56[.]104:8094 | botnet_cc | 2026-09-07 | 100% |
| ip:port | 154[.]91[.]58[.]124:8094 | botnet_cc | 2026-09-07 | 100% |
| ip:port | 154[.]91[.]58[.]126:8094 | botnet_cc | 2026-09-07 | 100% |
| ip:port | 154[.]91[.]58[.]125:8094 | botnet_cc | 2026-09-07 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["154.91.57.119", "154.91.57.118", "154.91.57.111", "154.91.57.125", "154.91.57.122", "154.91.58.126", "154.91.57.116", "154.91.57.110", "154.91.58.122", "154.91.58.124", "154.91.57.120", "154.91.56.104", "154.91.57.112", "154.91.58.116", "154.91.57.124", "154.91.58.98", "154.91.58.125"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["154.91.57.119", "154.91.57.118", "154.91.57.111", "154.91.57.125", "154.91.57.122", "154.91.58.126", "154.91.57.116", "154.91.57.110", "154.91.58.122", "154.91.58.124", "154.91.57.120", "154.91.56.104", "154.91.57.112", "154.91.58.116", "154.91.57.124", "154.91.58.98", "154.91.58.125"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps team uses the vshell CLI tool (a legitimate vendor-provided utility for virtual shell management in specific cloud or container environments) to automate configuration backups. The tool’s binary name or path matches one of the 17 IOCs, triggering the alert during a routine scheduled backup job.
vshell.exe or vshell AND the parent process is a known automation agent (e.g., ansible, chef-client, or systemd) AND the execution path resides in a standard application directory (e.g., C:\Program Files\VendorName\).Scenario: An IT administrator manually runs the vshell utility from a shared network drive (\\fileserver\tools\) to troubleshoot a user’s remote desktop session. The IOC matches the file hash or path, but the activity is benign and initiated by a privileged account during a documented maintenance window.
IT_Admins or Service_Accounts group AND the file path contains \\fileserver\tools\ AND the event occurs within the defined maintenance window (e.g., 02:00–04:00 UTC).Scenario: A security testing team conducts a red team exercise or penetration test and deploys a copy of the vshell binary (or a renamed variant matching an IOC) to validate detection coverage. The alert is expected but flagged as a false positive in the ticketing system if not tagged correctly.
PenTest_Subnet (e.g., 10.20.0.0/24) AND the user account is in the RedTeam group