ThreatFox: VShell IOCs

Hunt Hypothesis

This hunt targets adversary activity involving known VShell indicators of compromise to identify potential command-and-control communications or initial access attempts within the Azure environment. Proactively hunting these specific IOCs in Azure Sentinel is critical for early detection of this threat actor’s infrastructure before it establishes a persistent foothold, thereby reducing dwell time and mitigating high-severity risks.

IOC Summary

Malware Family: VShell Total IOCs: 25 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	154[.]88[.]99[.]59:8885	botnet_cc	2026-07-13	100%
ip:port	154[.]88[.]99[.]60:8885	botnet_cc	2026-07-13	100%
ip:port	154[.]88[.]99[.]58:8885	botnet_cc	2026-07-13	100%
ip:port	154[.]88[.]99[.]54:8885	botnet_cc	2026-07-13	100%
ip:port	154[.]88[.]99[.]53:8885	botnet_cc	2026-07-13	100%
ip:port	154[.]88[.]99[.]57:8885	botnet_cc	2026-07-13	100%
ip:port	154[.]88[.]99[.]50:8885	botnet_cc	2026-07-13	100%
ip:port	154[.]88[.]99[.]47:8885	botnet_cc	2026-07-13	100%
ip:port	154[.]88[.]99[.]49:8885	botnet_cc	2026-07-13	100%
ip:port	154[.]88[.]99[.]42:8885	botnet_cc	2026-07-13	100%
ip:port	154[.]88[.]99[.]44:8885	botnet_cc	2026-07-13	100%
ip:port	154[.]88[.]99[.]37:8885	botnet_cc	2026-07-13	100%
ip:port	154[.]88[.]99[.]36:8885	botnet_cc	2026-07-13	100%
ip:port	154[.]88[.]99[.]34:8885	botnet_cc	2026-07-13	100%
ip:port	154[.]88[.]99[.]35:8885	botnet_cc	2026-07-13	100%
ip:port	154[.]88[.]99[.]33:8885	botnet_cc	2026-07-13	100%
ip:port	154[.]88[.]97[.]56:8885	botnet_cc	2026-07-13	100%
ip:port	154[.]88[.]98[.]60:8885	botnet_cc	2026-07-13	100%
ip:port	154[.]88[.]98[.]47:8885	botnet_cc	2026-07-13	100%
ip:port	154[.]88[.]98[.]59:8885	botnet_cc	2026-07-13	100%
ip:port	154[.]88[.]97[.]54:8885	botnet_cc	2026-07-13	100%
ip:port	154[.]88[.]97[.]52:8885	botnet_cc	2026-07-13	100%
ip:port	154[.]88[.]96[.]39:8885	botnet_cc	2026-07-13	100%
ip:port	154[.]88[.]97[.]41:8885	botnet_cc	2026-07-13	100%
ip:port	154[.]88[.]97[.]43:8885	botnet_cc	2026-07-13	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["154.88.99.57", "154.88.99.60", "154.88.98.60", "154.88.99.58", "154.88.99.36", "154.88.97.52", "154.88.99.33", "154.88.99.44", "154.88.98.47", "154.88.99.49", "154.88.99.47", "154.88.99.59", "154.88.98.59", "154.88.99.53", "154.88.97.43", "154.88.97.56", "154.88.97.54", "154.88.99.50", "154.88.99.35", "154.88.96.39", "154.88.99.54", "154.88.97.41", "154.88.99.37", "154.88.99.34", "154.88.99.42"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["154.88.99.57", "154.88.99.60", "154.88.98.60", "154.88.99.58", "154.88.99.36", "154.88.97.52", "154.88.99.33", "154.88.99.44", "154.88.98.47", "154.88.99.49", "154.88.99.47", "154.88.99.59", "154.88.98.59", "154.88.99.53", "154.88.97.43", "154.88.97.56", "154.88.97.54", "154.88.99.50", "154.88.99.35", "154.88.96.39", "154.88.99.54", "154.88.97.41", "154.88.99.37", "154.88.99.34", "154.88.99.42"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
CommonSecurityLog	Ensure this data connector is enabled
DeviceNetworkEvents	Ensure this data connector is enabled

References

• ThreatFox — VShell

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: VShell IOCs detection rule in an enterprise environment, along with recommended filters or exclusions:

• Scenario: Scheduled Endpoint Protection Scans

  • Context: Enterprise security suites like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint frequently perform scheduled deep scans of network traffic and file hashes. During these windows, the agents may generate connections to VShell’s update servers or reputation feeds (matching specific IP ranges in the 25 IOCs) to verify threat intelligence data before reporting back to the SIEM.
  • Filter/Exclusion: Create an exclusion rule for network traffic originating from the specific Endpoint Agent Service accounts (e.g., svc-crowdstrike, SentinelOneService) during known maintenance windows (e.g., 02:00–04:00 UTC). Alternatively, filter out alerts where the destination port is standard update ports (80/443) and the source process hash matches the known signature of the EDR agent.

• Scenario: IT Admin Manual Patch Deployment

  • Context: System administrators often manually deploy patches or configuration updates to critical servers using tools like Microsoft SCCM (Configuration Manager) or Ansible. If an admin is troubleshooting a VShell-related vulnerability, they may initiate a direct connection from the management workstation to VShell’s command and control infrastructure to pull latest signatures or validate connectivity, triggering the IOC match.
  • Filter/Exclusion: Exclude alerts where the source IP belongs to the IT Operations VLAN (e.g., 10.x.x.0/24) and the user context is a member of the “Global Security Admins” group. Additionally, correlate with ticketing system logs (ServiceNow/Jira) to suppress alerts if an active ”