ThreatFox: VShell IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving specific indicators of compromise (IOCs) linked to the VShell malware, which is known to establish persistent backdoors and exfiltrate sensitive data from compromised endpoints. A SOC team should proactively hunt for these IOCs within Azure Sentinel to rapidly detect early-stage infections and mitigate potential lateral movement before attackers can solidify their foothold in the environment.

IOC Summary

Malware Family: VShell Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["154.201.95.162", "60.204.204.24"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["154.201.95.162", "60.204.204.24"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — VShell

False Positive Guidance

Here are the false positive scenarios and corresponding filters for the ThreatFox: VShell IOCs detection rule:

• Scenario: Automated Backup Agent Scanning

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik often utilize VShell components to scan virtual machine disks and network shares for integrity checks. These agents frequently generate I/O operations matching the specific hash signatures of VShell IOCs during scheduled nightly windows.
  • Filter/Exclusion: Exclude traffic originating from the specific Service Accounts used by backup software (e.g., svc-veeam-agent, rubrik-svc) and restrict the rule to exclude events occurring on known backup server hostnames (e.g., *.backup-cluster.local).

• Scenario: Virtualization Management Console Operations

  • Context: Administrators performing routine maintenance via VMware vCenter Server or Microsoft System Center Virtual Machine Manager (SCVMM) often trigger VShell processes to manage virtual hardware configurations, snapshot creation, or live migration tasks. These administrative actions generate legitimate I/O patterns that mimic the detection criteria.
  • Filter/Exclusion: Create an exclusion for process execution where the parent process is vpxd.exe (vCenter) or HostProcess.exe (SCVMM), and filter out events initiated by members of the Domain Admins group during standard business hours (08:00–18:00).

• Scenario: Third-Party Endpoint Protection Scans

  • Context: Security suites such as CrowdStrike Falcon, Carbon Black, or Symantec Endpoint Protection may utilize VShell libraries for their own real-time file system monitoring and behavioral analysis modules. When these agents perform deep-scan operations on critical system directories, they trigger the same IOCs defined in the rule.