ThreatFox: VShell IOCs

Hunt Hypothesis

This hunt targets the presence of VShell, a lightweight web shell often used by adversaries to establish persistent access and execute commands on compromised Azure resources. Proactively hunting for these IOCs allows the SOC to identify stealthy backdoors that may have been deployed to bypass standard monitoring, ensuring rapid containment before the attacker leverages the shell for lateral movement or data exfiltration.

IOC Summary

Malware Family: VShell Total IOCs: 3 IOC Types: url, sha256_hash

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - VShell
let malicious_urls = dynamic(["http://192.25.102.246:8088/?h=192.25.102.246&p=8088&t=tcp&a=w32&stage=true", "http://192.25.102.246:8088/?h=192.25.102.246&p=8088&t=ws&a=w32&stage=true"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - VShell
let malicious_hashes = dynamic(["969c61a682310cfd072bf83562aea45223b0687b92d7a0aab0ab0a773116bb14"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — VShell

False Positive Guidance

• Scenario: A DevOps engineer uses vshell (or a similar lightweight shell wrapper) within a CI/CD pipeline container to execute quick diagnostic commands or log parsing tasks.
  • Filter/Exclusion: Exclude processes where the parent process is a container runtime (e.g., dockerd, containerd-shim) or where the command line contains specific CI/CD environment variables (e.g., JENKINS_URL, GITHUB_ACTIONS).
• Scenario: An IT support team member runs a scheduled PowerShell script that invokes a helper binary named vshell.exe (a common naming convention for internal tooling) to rotate logs or clean up temp files on a jump host.
  • Filter/Exclusion: Exclude events where the parent process is powershell.exe or pwsh.exe and the working directory is a known administrative path (e.g., C:\AdminTools\, C:\Scripts\).
• Scenario: A security testing team performs a red team exercise or penetration test, intentionally deploying a benign copy of VShell to validate detection coverage before a major release.
  • Filter/Exclusion: Exclude events occurring within a designated “Testing” or “RedTeam” AD security group, or where the user account name matches a pattern like RT_ or PENTEST_.
• Scenario: A legacy application installer or service updater uses a bundled shell utility named vshell to perform post-install configuration steps during a patch Tuesday update.
  • Filter/Exclusion: Exclude processes where the parent process is a known installer executable (e.g., msiexec.exe, setup.exe) or where the process path resides in a vendor-specific directory (e.g., C:\Program Files\VendorApp\bin\).