ThreatFox: VShell IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving specific Indicators of Compromise (IOCs) linked to the VShell threat intelligence feed, signaling potential reconnaissance or command-and-control operations within the environment. The SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly validate and isolate compromised assets before adversaries can establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: VShell Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["45.130.147.57", "111.229.135.130", "192.25.102.246"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.130.147.57", "111.229.135.130", "192.25.102.246"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — VShell

False Positive Guidance

Here are the false positive scenarios and corresponding exclusions for the ThreatFox: VShell IOCs detection rule:

• Scenario: Automated vulnerability scanning by internal security teams using Tenable Nessus or Qualys agents. These tools frequently initiate outbound connections to threat intelligence feeds (including VShell) to update their local signature databases, triggering network flow and DNS queries that match the VShell IOCs.

  • Filter/Exclusion: Create a rule exclusion based on the source IP address of the internal scanning servers or the specific process name nessus.exe / qualyspc.exe. Additionally, filter out traffic occurring during known maintenance windows (e.g., 02:00–04:00 UTC).

• Scenario: Scheduled administrative tasks performed by IT Operations using Microsoft Endpoint Configuration Manager (SCCM) or Intune. During the daily “Software Update” cycle, these agents query external repositories and threat feeds to validate patch integrity, generating legitimate DNS lookups and HTTPS connections to VShell endpoints.

  • Filter/Exclusion: Exclude traffic originating from the specific AD Organizational Unit (OU) containing “Workstation Management Agents.” Alternatively, filter based on the process path C:\Program Files\Microsoft Configuration Manager\AdminConsole or C:\Windows\System32\ccmexec.exe.

• Scenario: Legitimate usage of third-party endpoint protection suites like CrowdStrike Falcon or SentinelOne. These EDR solutions often utilize VShell’s threat intelligence API to enrich their local detection logic, resulting in periodic heartbeat connections and IOC ingestion that mimic the rule’s trigger conditions.

  • Filter/Exclusion: Implement a whitelist for the specific process names FalconSensorService.exe (CrowdStrike) or SentinelOneAgent.exe. Ensure the exclusion applies to traffic destined for the known VShell IP ranges