This detection identifies adversary activity involving known VShell indicators of compromise (IOCs) that may signal unauthorized access or command-and-control communications within the Azure environment. Proactive hunting for these specific IOCs is critical to rapidly identify and contain potential threats before they escalate into broader incidents, ensuring timely response to high-severity risks associated with the VShell ecosystem.
Malware Family: VShell Total IOCs: 39 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 35[.]198[.]202[.]239:8080 | botnet_cc | 2026-08-22 | 100% |
| ip:port | 43[.]143[.]14[.]43:8443 | botnet_cc | 2026-08-22 | 100% |
| ip:port | 47[.]97[.]0[.]198:8443 | botnet_cc | 2026-08-22 | 100% |
| ip:port | 123[.]60[.]182[.]111:9999 | botnet_cc | 2026-08-22 | 75% |
| ip:port | 43[.]136[.]180[.]65:9080 | botnet_cc | 2026-08-22 | 75% |
| ip:port | 182[.]16[.]98[.]92:21 | botnet_cc | 2026-08-22 | 75% |
| ip:port | 182[.]16[.]98[.]85:21 | botnet_cc | 2026-08-22 | 75% |
| ip:port | 182[.]16[.]98[.]94:2333 | botnet_cc | 2026-08-22 | 75% |
| ip:port | 119[.]42[.]148[.]189:8081 | botnet_cc | 2026-08-22 | 75% |
| ip:port | 101[.]34[.]218[.]233:8887 | botnet_cc | 2026-08-22 | 75% |
| ip:port | 182[.]16[.]98[.]82:1443 | botnet_cc | 2026-08-22 | 75% |
| ip:port | 182[.]16[.]98[.]87:21 | botnet_cc | 2026-08-22 | 75% |
| ip:port | 182[.]16[.]98[.]89:8080 | botnet_cc | 2026-08-22 | 75% |
| ip:port | 154[.]31[.]219[.]205:80 | botnet_cc | 2026-08-22 | 75% |
| ip:port | 45[.]192[.]213[.]14:8081 | botnet_cc | 2026-08-22 | 75% |
| ip:port | 124[.]220[.]0[.]201:7777 | botnet_cc | 2026-08-22 | 75% |
| ip:port | 103[.]163[.]47[.]52:10010 | botnet_cc | 2026-08-22 | 75% |
| ip:port | 129[.]204[.]10[.]223:8028 | botnet_cc | 2026-08-22 | 75% |
| ip:port | 207[.]57[.]188[.]112:8084 | botnet_cc | 2026-08-22 | 75% |
| ip:port | 104[.]168[.]19[.]222:9000 | botnet_cc | 2026-08-22 | 75% |
| ip:port | 23[.]95[.]243[.]47:8080 | botnet_cc | 2026-08-22 | 75% |
| ip:port | 216[.]152[.]152[.]241:80 | botnet_cc | 2026-08-22 | 75% |
| ip:port | 50[.]114[.]177[.]151:809 | botnet_cc | 2026-08-22 | 75% |
| ip:port | 192[.]129[.]141[.]183:7777 | botnet_cc | 2026-08-22 | 75% |
| ip:port | 119[.]45[.]224[.]18:8087 | botnet_cc | 2026-08-22 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["192.129.141.183", "35.198.202.239", "43.138.167.38", "45.194.17.183", "119.3.155.80", "193.134.209.166", "43.143.14.43", "47.97.0.198", "119.42.148.189", "119.45.224.18", "116.205.186.56", "182.16.98.87", "47.237.156.196", "182.16.98.89", "107.149.135.116", "207.57.188.112", "151.245.90.134", "182.16.98.92", "134.209.214.178", "124.220.0.201", "101.34.218.233", "129.204.10.223", "154.31.219.205", "123.60.182.111", "50.114.184.157", "104.168.19.222", "23.95.243.47", "111.229.153.119", "1.94.176.236", "182.16.98.82", "182.16.98.85", "153.75.91.200", "182.16.98.94", "45.192.213.14", "216.152.152.241", "113.45.168.139", "43.136.180.65", "103.163.47.52", "50.114.177.151"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["192.129.141.183", "35.198.202.239", "43.138.167.38", "45.194.17.183", "119.3.155.80", "193.134.209.166", "43.143.14.43", "47.97.0.198", "119.42.148.189", "119.45.224.18", "116.205.186.56", "182.16.98.87", "47.237.156.196", "182.16.98.89", "107.149.135.116", "207.57.188.112", "151.245.90.134", "182.16.98.92", "134.209.214.178", "124.220.0.201", "101.34.218.233", "129.204.10.223", "154.31.219.205", "123.60.182.111", "50.114.184.157", "104.168.19.222", "23.95.243.47", "111.229.153.119", "1.94.176.236", "182.16.98.82", "182.16.98.85", "153.75.91.200", "182.16.98.94", "45.192.213.14", "216.152.152.241", "113.45.168.139", "43.136.180.65", "103.163.47.52", "50.114.177.151"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: Legitimate deployment of the VShell remote access solution by the IT Operations team on new or updated workstations within the R&D department. This often triggers when the installer or configuration scripts query external VShell management servers to download policy definitions, matching the specific IOCs in the hunt package.
VShell application directory (e.g., C:\Program Files\VShell\) where the parent process is a known installer like msiexec.exe or InstallShield.exe, specifically during business hours on workstations tagged with the “R&D” AD group.Scenario: Scheduled nightly backup jobs utilizing Veeam Backup & Replication agents that include VShell components in their inventory scan. The agent periodically contacts VShell IOCs to verify remote session status or sync audit logs, generating network connections and file accesses that mimic the threat signature.
VeeamAgent.exe (or vbrservice.exe) running on servers within the “Backup-Cluster” subnet, focusing specifically on the IOCs related to VShell’s management port traffic during the defined maintenance window (e.g., 02:00–04:00 UTC).Scenario: Automated compliance scanning performed by Qualys Cloud Agent or Tenable Nessus, which actively probes internal endpoints to verify the presence and version of remote access tools. The scanner’s engine queries VShell specific registry keys and network ports, triggering the detection logic as it validates the IOCs against the host environment.
qualyspc.exe or tenable_agent.exe and the destination IP belongs to the internal Qualys/Tenable management server range, ensuring that only