This hunt targets the presence of VShell, a lightweight web shell often deployed by adversaries to establish persistent access and execute commands within compromised Azure environments. Proactively hunting for these IOCs allows the SOC team to identify stealthy backdoors that may evade standard detection, enabling rapid containment before attackers leverage the shell for lateral movement or data exfiltration.
Malware Family: VShell Total IOCs: 6 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 154[.]91[.]63[.]100:8084 | botnet_cc | 2026-09-03 | 100% |
| ip:port | 154[.]91[.]63[.]116:8084 | botnet_cc | 2026-09-03 | 100% |
| ip:port | 154[.]91[.]62[.]126:8084 | botnet_cc | 2026-09-03 | 100% |
| ip:port | 1[.]12[.]59[.]176:8084 | botnet_cc | 2026-09-03 | 100% |
| ip:port | 47[.]94[.]178[.]217:8084 | botnet_cc | 2026-09-03 | 100% |
| ip:port | 64[.]81[.]114[.]71:8888 | botnet_cc | 2026-09-03 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["154.91.62.126", "47.94.178.217", "154.91.63.100", "1.12.59.176", "154.91.63.116", "64.81.114.71"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["154.91.62.126", "47.94.178.217", "154.91.63.100", "1.12.59.176", "154.91.63.116", "64.81.114.71"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Automated Patch Management via SCCM/Intune: Enterprise patching solutions like Microsoft System Center Configuration Manager (SCCM) or Intune often execute PowerShell scripts or binaries from specific paths (e.g., C:\Windows\CCM\ or C:\Program Files\Microsoft Intune\) to apply updates. If the VShell IOCs include generic PowerShell execution or specific binary names that overlap with patching agents, this can trigger alerts.
C:\Windows\CCM\, C:\Program Files\Microsoft Intune\, or C:\Program Files (x86)\Microsoft System Center 2012 R2\. Additionally, whitelist parent processes such as ccmexec.exe or IntuneAgent.exe.Third-Party Endpoint Protection Scans: Security tools like CrowdStrike Falcon, Carbon Black, or SentinelOne frequently spawn temporary PowerShell or cmd.exe processes to perform deep system scans, collect telemetry, or execute remediation scripts. These tools may use paths or command-line arguments that match the VShell IOCs (e.g., generic powershell.exe -ExecutionPolicy Bypass or specific script locations in temp folders).
FalconSensor.exe, cb.exe, or sentineloneagent.exe. Also, whitelist command lines containing specific vendor identifiers like -falcon or -carbonblack if the IOC is based on command-line string matching.Scheduled Backup and Cleanup Jobs: Enterprise backup solutions (e.g., Veeam, Commvault) or disk cleanup utilities often run scheduled tasks that execute PowerShell scripts to manage snapshots, delete old logs, or verify disk space. These scripts are frequently stored in C:\ProgramData\ or C:\Windows\Temp\ and may use execution policies