ThreatFox: VShell IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity involving known VShell indicators of compromise (IOCs) that may signal active reconnaissance or lateral movement within the network. Proactively hunting for these specific IOCs in Azure Sentinel is critical to rapidly detect and contain potential threats before they escalate, given the high severity associated with this threat intelligence feed.

IOC Summary

Malware Family: VShell Total IOCs: 8 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`111[.]230[.]241[.]141:18084`	botnet_cc	2026-08-23	100%
ip:port	`118[.]190[.]217[.]226:18084`	botnet_cc	2026-08-23	100%
ip:port	`27[.]124[.]18[.]7:9999`	botnet_cc	2026-08-23	100%
ip:port	`47[.]93[.]159[.]68:8084`	botnet_cc	2026-08-23	100%
ip:port	`101[.]200[.]193[.]211:8084`	botnet_cc	2026-08-23	100%
ip:port	`101[.]42[.]96[.]140:9999`	botnet_cc	2026-08-23	100%
ip:port	`152[.]136[.]43[.]50:8001`	botnet_cc	2026-08-23	100%
ip:port	`27[.]124[.]18[.]6:9999`	botnet_cc	2026-08-23	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["27.124.18.7", "118.190.217.226", "101.42.96.140", "101.200.193.211", "47.93.159.68", "27.124.18.6", "152.136.43.50", "111.230.241.141"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["27.124.18.7", "118.190.217.226", "101.42.96.140", "101.200.193.211", "47.93.159.68", "27.124.18.6", "152.136.43.50", "111.230.241.141"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — VShell

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: VShell IOCs detection rule, including targeted filters and exclusions tailored to an enterprise environment:

Scenario: Automated Vulnerability Scanning via Qualys or Tenable
- Context: Enterprise vulnerability management tools (e.g., Qualys Cloud Agent, Tenable Nessus) frequently scan endpoints for known CVEs. These scanners often download configuration files or update their internal IOC databases from the internet, which can trigger network connections to VShell-associated IP addresses or domains used by third-party threat intelligence feeds integrated within the scanner.
- Filter/Exclusion: Create a rule exclusion based on the Source Host being part of the “Vulnerability Management” Active Directory group, or filter out traffic where the Process Name matches qualyspc.exe, tenable-agent.exe, or nscd.exe.
Scenario: Scheduled Endpoint Protection Policy Updates (CrowdStrike/Carbon Black)
- Context: EDR solutions like CrowdStrike Falcon or Carbon Black Defender run scheduled jobs to pull the latest threat intelligence signatures. If the VShell IOCs include specific hash values or URLs used by these vendors’ update servers, legitimate policy refreshes occurring during maintenance windows (e.g., 2:00 AM - 4:00 AM) will trigger alerts.
- Filter/Exclusion: Implement a time-based exclusion window for the rule between 02:00 and 06:00 on weekdays, or exclude events where the Process Command Line contains keywords like “UpdateService”, “PolicySync”, or specific vendor executable names (e.g., falconagent.exe, cbset.exe).
Scenario: Admin-Initiated Threat Intelligence Feed Integration via SIEM
- Context: Security Operations teams often