ThreatFox: VShell IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity by correlating five specific Indicators of Compromise (IOCs) linked to the VShell threat, signaling potential reconnaissance or command-and-control operations within the network. A proactive hunt is essential in Azure Sentinel to rapidly isolate affected assets and mitigate risks before the adversary can establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: VShell Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`118[.]184[.]173[.]168:8084`	botnet_cc	2026-08-16	100%
ip:port	`47[.]98[.]133[.]252:8085`	botnet_cc	2026-08-16	100%
ip:port	`47[.]98[.]133[.]252:8083`	botnet_cc	2026-08-16	100%
ip:port	`180[.]76[.]53[.]183:4433`	botnet_cc	2026-08-15	100%
ip:port	`162[.]14[.]116[.]65:18084`	botnet_cc	2026-08-15	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["162.14.116.65", "47.98.133.252", "180.76.53.183", "118.184.173.168"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["162.14.116.65", "47.98.133.252", "180.76.53.183", "118.184.173.168"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — VShell

False Positive Guidance

Here are the false positive scenarios and corresponding exclusions for the ThreatFox: VShell IOCs detection rule:

Scenario: Automated Patch Management Deployment
- Context: The enterprise utilizes Microsoft Endpoint Configuration Manager (SCCM) or Intune to deploy a scheduled security update package. This process triggers a background service that downloads and executes the specific VShell signature files, matching the 5 IOCs in the hunt package.
- Filter/Exclusion: Exclude alerts where the Process_Name is ccmsetup.exe or Microsoft.Intune.AgentService AND the Parent_Process_Name matches the deployment engine (e.g., WUAHandler.exe). Additionally, filter by User_Account equal to SYSTEM during the defined maintenance window (e.g., 02:00–04:00 UTC).
Scenario: Endpoint Protection Engine Update
- Context: The organization’s primary EDR solution, such as CrowdStrike Falcon or SentinelOne, performs a routine definition update. The update mechanism downloads the VShell IOCs to the local agent cache for analysis before activation, generating network and file system events that mimic the threat signature.
- Filter/Exclusion: Create an exclusion rule where Process_Path contains \Program Files\CrowdStrike\ or \SentinelOne\SentinelOne\. Filter out events where the Event_Type is “File Creation” with a timestamp matching the daily update cycle (e.g., every day at 06:00 AM) and the file extension is .dat or .cab.
Scenario: Scheduled Compliance Audit Script
- Context: A nightly PowerShell script, scheduled via Windows Task Scheduler, runs a compliance check against the VShell environment. The script explicitly queries the registry keys and