ThreatFox: VShell IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets adversary behavior involving the execution of known VShell indicators of compromise to detect potential command-and-control communications or lateral movement within the network. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early identification of this high-severity threat can prevent data exfiltration and reduce dwell time before automated detection triggers.

IOC Summary

Malware Family: VShell Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`162[.]14[.]110[.]164:8084`	botnet_cc	2026-07-15	100%
ip:port	`107[.]174[.]186[.]201:9090`	botnet_cc	2026-07-15	100%
ip:port	`34[.]21[.]206[.]134:8080`	botnet_cc	2026-07-15	100%
ip:port	`121[.]40[.]49[.]4:8084`	botnet_cc	2026-07-15	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["121.40.49.4", "162.14.110.164", "107.174.186.201", "34.21.206.134"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["121.40.49.4", "162.14.110.164", "107.174.186.201", "34.21.206.134"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — VShell

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: VShell IOCs detection rule, tailored for an enterprise environment where legitimate administrative activities may mimic the behavior of the VShell threat indicators.

Endpoint Protection Policy Deployment via Microsoft Intune
- Scenario: During a scheduled maintenance window, the Security Operations team pushes a new configuration policy to all Windows 10/11 endpoints using Microsoft Intune. This deployment includes a script that queries system health and downloads definition updates from an internal repository. The network traffic generated by this script matches the specific IP ranges or file hashes associated with VShell IOCs, triggering the rule on hundreds of workstations simultaneously.
- Suggested Filter/Exclusion: Create an exclusion for network flows originating from the Intune Management Service (specifically Microsoft.Intune.Management process) and traffic destined to the internal software distribution server’s IP range. Additionally, exclude events where the source user is a member of the IT-Admins security group during the defined maintenance window (e.g., Sundays 02:00–04:00 UTC).
Automated Log Collection via Splunk Universal Forwarder
- Scenario: The enterprise utilizes Splunk Universal Forwarders installed on critical servers to aggregate logs. A scheduled job runs every hour to compress and transmit log archives to the central indexers. If the VShell IOCs include specific file signatures or outbound connections to cloud storage endpoints used for backup, the forwarder’s routine transmission of large log files will trigger the detection logic as a potential threat communication.
- Suggested Filter/Exclusion: Add an exclusion rule based on the process name splunk-forwarder.exe (or sfwd.exe) and restrict the scope to traffic destined for the known Splunk Indexer IP subnets. Furthermore, filter out events where the file