ThreatFox: VShell IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection identifies adversary activity involving four specific indicators of compromise (IOCs) linked to the VShell remote access tool, which is frequently leveraged by threat actors for persistent command and control or lateral movement within enterprise networks. A proactive hunt in Azure Sentinel is critical because early identification of these IOCs allows the SOC team to isolate compromised endpoints before attackers can establish deep footholds or exfiltrate sensitive data through this trusted utility.

IOC Summary

Malware Family: VShell Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`8[.]137[.]98[.]198:8089`	botnet_cc	2026-08-20	100%
ip:port	`180[.]76[.]172[.]229:8084`	botnet_cc	2026-08-20	100%
ip:port	`43[.]226[.]40[.]204:9443`	botnet_cc	2026-08-20	100%
ip:port	`116[.]205[.]106[.]137:9997`	botnet_cc	2026-08-20	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["116.205.106.137", "180.76.172.229", "8.137.98.198", "43.226.40.204"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["116.205.106.137", "180.76.172.229", "8.137.98.198", "43.226.40.204"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — VShell

False Positive Guidance

Here are the documented false positive scenarios and corresponding filters for the ThreatFox: VShell IOCs detection rule:

Scenario: Automated Patch Management Deployment
- Context: The enterprise’s patch management system (e.g., Microsoft SCCM/Endpoint Configuration Manager or Ivanti) pushes a security update that includes the VShell agent. During the deployment window, multiple endpoints simultaneously initiate the installation service, triggering network connections to VShell update servers and file creation events matching the 4 IOCs.
- Suggested Filter: Exclude traffic originating from the specific IP ranges of the Patch Management Servers or filter events where the Process Name matches the known patch installer executable (e.g., ccmsetup.exe) rather than a generic user process.
Scenario: Scheduled Endpoint Security Health Checks
- Context: A nightly scheduled task runs on all workstations to verify the status of the endpoint security suite. This job invokes a script that queries the local VShell service via its API or checks specific registry keys and log files defined in the IOC set, generating legitimate network and file system alerts.
- Suggested Filter: Create an exclusion for events occurring during the maintenance window (e.g., 02:00 – 04:00 local time) where the User Account is a dedicated service account (e.g., NT SERVICE\VShellHealthCheck) or the process path matches the scheduled task script location.
Scenario: Onboarding of New Virtual Desktop Infrastructure (VDI)
- Context: The IT Operations team provisions new virtual desktops using VMware Horizon or Citrix XenApp. As part of the golden image build, the VShell agent is installed and immediately registers with the central management console. This initial handshake triggers all 4 IOCs (network connection, file creation,