URLhaus: vshell Malicious URLs

Hunt Hypothesis

This hypothesis targets the execution of the vshell reverse shell payload, a tool frequently used by adversaries to establish persistent remote access and facilitate command-and-control communications. Proactively hunting for these specific URLs in Azure Sentinel allows the SOC team to identify compromised endpoints before the attacker can fully leverage the shell for lateral movement or data exfiltration.

IOC Summary

Threat: vshell Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: vshell
let malicious_domains = dynamic(["139.95.24.51", "175.27.140.230", "222.112.70.149"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["139.95.24.51", "175.27.140.230", "222.112.70.149"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses a version control system (e.g., GitLab or GitHub) to host a lightweight internal dashboard or API gateway that shares the same domain structure as a known vshell instance.
  • Filter/Exclusion: Exclude URLs where the path contains /api/, /dashboard/, or /webhook/ and the HTTP response header Server matches nginx or apache rather than a generic shell interpreter.
• Scenario: A security team deploys a canary token or honeypot URL (e.g., using canarytokens.org or internal honeytoken.io) that mimics the vshell URL pattern to detect unauthorized access, but the URL is accessed by the monitoring agent itself.
  • Filter/Exclusion: Exclude events where the source IP address belongs to the designated monitoring subnet (e.g., 10.20.30.0/24) or where the user agent string contains CanaryToken or HoneypotMonitor.
• Scenario: An automated backup or sync job (e.g., using rsync or aws s3 sync) pulls configuration files from a staging server that has a temporary vshell-like URL structure for debugging purposes, which is not yet cleaned up.
  • Filter/Exclusion: Exclude URLs ending in .json, .yaml, or .conf and where the HTTP method is GET with a status code of 200, specifically if the source process is rsync, curl, or wget initiated by a service account.
• Scenario: A developer tests a new microservice locally using a proxy tool (e.g., ngrok or cloudflared) that generates a unique subdomain matching the vshell pattern, and the service is accessed by an integration test suite.