ThreatFox: VShell IOCs

Hunt Hypothesis

This hunt targets the presence of VShell, a lightweight SSH server often used by adversaries to establish covert remote access channels on compromised hosts. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify stealthy persistence mechanisms that may bypass standard monitoring, ensuring rapid detection of unauthorized backdoors before they are leveraged for lateral movement or data exfiltration.

This hunt targets the presence of VShell, a lightweight SSH server often used by adversaries to establish covert remote access channels on compromised hosts. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify stealthy persistence mechanisms that may bypass standard monitoring, ensuring rapid detection of unauthorized backdoors before they are leveraged for lateral movement or data exfiltration.

IOC Summary

Malware Family: VShell Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["145.79.143.166", "154.91.58.114"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["145.79.143.166", "154.91.58.114"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — VShell

False Positive Guidance

• Scenario: A DevOps engineer uses vshell (or a similar lightweight SSH alternative) as a temporary diagnostic tool to troubleshoot network connectivity issues on a Windows server where standard SSH clients are not installed.

  • Filter/Exclusion: Exclude alerts where the process name is vshell.exe or vshell and the parent process is a known interactive shell like cmd.exe, powershell.exe, or wt.exe (Windows Terminal), provided the user account belongs to the DevOps or IT Support security group.

• Scenario: A security team conducts a red team exercise or penetration test and deploys VShell as a covert backdoor to simulate an advanced persistent threat (APT) scenario.

  • Filter/Exclusion: Correlate the alert with the active “Penetration Test” or “Red Team” ticket ID in the ITSM system (e.g., ServiceNow, Jira). If the timestamp of the alert falls within the approved window of the active red team engagement, suppress the alert or tag it as “Expected – Red Team Activity.”

• Scenario: An application deployment pipeline uses a custom build agent that bundles VShell for remote execution of post-deployment scripts on target nodes.

  • Filter/Exclusion: Exclude alerts where the VShell process is launched by a known build agent process (e.g., jenkins-agent.exe, azure-pipelines-agent.exe, or gitlab-runner.exe) and the working directory is within the designated build artifacts folder (e.g., C:\builds\ or /var/lib/jenkins/).

• Scenario: A legacy application maintenance script uses VShell to perform automated health checks and log rotations on a cluster of servers.

  • Filter/Exclusion: Create a scheduled task exclusion for the specific service account used by the maintenance script (e.g