This hypothesis targets the presence of VShell, a lightweight remote access tool frequently used by adversaries to establish covert command-and-control channels or maintain persistence within compromised systems. Proactively hunting for these specific IOCs in Azure Sentinel allows the SOC to identify stealthy backdoors that may evade standard network monitoring, ensuring rapid containment of high-severity threats before they are leveraged for lateral movement or data exfiltration.
This hypothesis targets the presence of VShell, a lightweight remote access tool frequently used by adversaries to establish covert command-and-control channels or maintain persistence within compromised systems. Proactively hunting for these specific IOCs in Azure Sentinel allows the SOC to identify stealthy backdoors that may evade standard network monitoring, ensuring rapid containment of high-severity threats before they are leveraged for lateral movement or data exfiltration.
Malware Family: VShell Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 47[.]109[.]176[.]249:3389 | botnet_cc | 2026-09-14 | 100% |
| ip:port | 47[.]103[.]114[.]97:8103 | botnet_cc | 2026-09-14 | 100% |
| ip:port | 192[.]187[.]118[.]179:8084 | botnet_cc | 2026-09-14 | 100% |
| ip:port | 209[.]200[.]252[.]43:8084 | botnet_cc | 2026-09-14 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["209.200.252.43", "47.109.176.249", "47.103.114.97", "192.187.118.179"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["209.200.252.43", "47.109.176.249", "47.103.114.97", "192.187.118.179"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses a custom Python wrapper or PowerShell script to automate the deployment of internal microservices, where the script explicitly calls vshell (or a binary with that name) to initialize a lightweight service tunnel for health checks.
python.exe or pwsh.exe and the command line contains specific internal flags (e.g., --health-check or --internal-tunnel) or originates from a known CI/CD service account (e.g., svc-cicd-deploy).Scenario: An IT administrator performs a manual security audit by downloading the VShell binary to a temporary directory (C:\Temp\ or C:\Users\<admin>\Downloads\) to test its behavior in an isolated lab environment before approving it for production use.
Temp, Downloads, or Lab directories, and the user belongs to a specific security testing group (e.g., SEC-Testers), provided the execution does not persist or spawn child processes like cmd.exe with suspicious arguments.Scenario: A third-party application installer (e.g., a legacy Java-based enterprise tool) bundles a component named vshell or uses it as a helper utility for local inter-process communication during installation, running from a standard vendor directory like C:\Program Files\<VendorName>\.
C:\Program Files\AcmeCorp\ or C:\Program Files (x86)\LegacyApp\) and the parent process is the vendor’s main installer executable (e.g., setup.exe or installer.exe).Scenario: A scheduled maintenance job