ThreatFox: VShell IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity involving known VShell indicators of compromise (IOCs) that signal potential command-and-control or lateral movement within the network. A proactive hunt is essential in Azure Sentinel to rapidly isolate and investigate these specific threats before they escalate into broader incidents, leveraging high-severity alerts to prioritize immediate response actions.

IOC Summary

Malware Family: VShell Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`180[.]76[.]135[.]85:8084`	botnet_cc	2026-08-25	100%
ip:port	`154[.]221[.]17[.]62:18080`	botnet_cc	2026-08-25	100%
ip:port	`150[.]129[.]80[.]247:8083`	botnet_cc	2026-08-25	100%
ip:port	`143[.]92[.]62[.]110:8083`	botnet_cc	2026-08-25	100%
ip:port	`114[.]132[.]178[.]92:8084`	botnet_cc	2026-08-25	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["154.221.17.62", "143.92.62.110", "114.132.178.92", "150.129.80.247", "180.76.135.85"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["154.221.17.62", "143.92.62.110", "114.132.178.92", "150.129.80.247", "180.76.135.85"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — VShell

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: VShell IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

Scenario: Automated Vulnerability Scanning by Qualys or Tenable
- Context: Enterprise vulnerability management platforms (e.g., Qualys Cloud Agent, Tenable Nessus) often initiate network connections to known VShell endpoints during scheduled scans to verify agent health or retrieve configuration data. These scans generate traffic matching the 5 specific IOCs defined in the rule.
- Filter/Exclusion: Create a whitelist exclusion for source IPs belonging to the vulnerability management infrastructure (e.g., Source_IP IN [Qualys_Scan_Range]) and filter events where the process name matches known scanner agents (Process_Name = 'qualyspc.exe' OR Process_Name = 'tenable_agent.exe').
Scenario: Scheduled Backup Jobs via Veeam or Commvault
- Context: During nightly backup windows, enterprise backup solutions like Veeam Backup & Replication or Commvault often communicate with the VShell management portal to retrieve inventory manifests or trigger policy updates. This legitimate administrative traffic triggers the IOCs associated with VShell connectivity.
- Filter/Exclusion: Exclude events occurring during defined maintenance windows (e.g., Event_Time BETWEEN 01:00 AND 06:00) where the initiating process is a known backup service (Process_Name = 'VeeamService.exe' OR Process_Name = 'commvault_agent.exe').
Scenario: IT Admin Remote Management via Microsoft Endpoint Manager (Intune)
- Context: System administrators frequently use Microsoft Endpoint Manager to push configuration profiles or run scripts that require connectivity to the VShell environment. When admins trigger a “Run Command” or “Install App” action,