ThreatFox: VShell IOCs

Hunt Hypothesis

This detection identifies adversary activity involving the VShell remote access tool by monitoring specific indicators of compromise (IOCs) that signal potential unauthorized command and control or lateral movement within the network. A proactive hunt is essential in Azure Sentinel to rapidly isolate compromised endpoints and prevent attackers from leveraging this legitimate tool for persistent, stealthy operations before they can establish a foothold.

IOC Summary

Malware Family: VShell Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["1.15.179.110", "222.112.70.149"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["1.15.179.110", "222.112.70.149"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — VShell

False Positive Guidance

Here are the documented false positive scenarios and corresponding exclusions for the ThreatFox: VShell IOCs detection rule:

• Scenario 1: Endpoint Management Agent Communication

  • Context: The enterprise utilizes Microsoft Intune or Jamf Pro to deploy security updates. These agents frequently initiate outbound connections to vendor update servers that share IP ranges or domain hashes with the VShell IOCs, particularly during nightly patch cycles.
  • Filter/Exclusion: Create a whitelist entry for the specific process names of the management agents (e.g., IntuneManagementExtension.exe or jamfagentd) communicating to the known vendor update domains. Exclude these process-execution pairs from triggering alerts on VShell IOCs.

• Scenario 2: Scheduled Backup and Archiving Jobs

  • Context: A nightly Veeam Backup & Replication job runs at 01:00 AM to archive logs to an off-site repository. The backup software’s network module utilizes a shared CDN or storage endpoint that matches the VShell IOCs, causing high-volume traffic spikes that mimic threat signatures.
  • Filter/Exclusion: Implement a time-based exclusion window (e.g., 00:30–02:30) for the backup service account (svc_backup_admin). Alternatively, exclude traffic originating from the specific backup server hostname or IP range when communicating with the identified IOCs.

• Scenario 3: Admin-Driven Cloud Migration Tasks

  • Context: During a quarterly migration of legacy data to Azure Blob Storage, administrators run PowerShell scripts using AzCopy or custom Python automation tools. These scripts often query external metadata services that overlap with the VShell IOC domain, generating legitimate “first-seen” connection events.
  • Filter/Exclusion: Add an exclusion for user accounts belonging