ThreatFox: VShell IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection identifies adversary activity involving six specific indicators of compromise (IOCs) linked to the VShell remote access tool, which is frequently leveraged by threat actors to establish persistent command and control channels within compromised networks. Proactive hunting for these IOCs in Azure Sentinel is critical because early identification of VShell-related anomalies enables the SOC team to rapidly isolate affected endpoints before adversaries can escalate privileges or exfiltrate sensitive data.

IOC Summary

Malware Family: VShell Total IOCs: 6 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`192[.]210[.]197[.]13:8080`	botnet_cc	2026-08-01	100%
ip:port	`156[.]238[.]120[.]13:18084`	botnet_cc	2026-08-01	100%
ip:port	`119[.]45[.]160[.]160:18089`	botnet_cc	2026-08-01	100%
ip:port	`143[.]198[.]207[.]128:57001`	botnet_cc	2026-08-01	100%
ip:port	`23[.]254[.]208[.]236:9895`	botnet_cc	2026-08-01	100%
ip:port	`23[.]254[.]208[.]236:8084`	botnet_cc	2026-08-01	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["156.238.120.13", "23.254.208.236", "192.210.197.13", "119.45.160.160", "143.198.207.128"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["156.238.120.13", "23.254.208.236", "192.210.197.13", "119.45.160.160", "143.198.207.128"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — VShell

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: VShell IOCs detection rule in an enterprise environment:

Scenario: Automated Backup Agent Scans
- Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik often utilize embedded agents that perform deep file system scans and network connectivity checks. These agents may generate connection patterns or process behaviors matching the VShell IOCs (e.g., specific DNS queries or outbound ports) while indexing data repositories.
- Filter/Exclusion: Create a whitelist rule excluding alerts where the Process Name is vbr.exe (Veeam) or rubrik-agent.exe, and the Source IP belongs to the dedicated Backup Subnet range (e.g., 10.20.40.0/24).
Scenario: Scheduled Endpoint Security Health Checks
- Context: Managed security platforms such as CrowdStrike Falcon or SentinelOne run periodic scheduled jobs to verify agent health, update definitions, and sync telemetry with the management console. During these windows (typically early morning), the agents may initiate network connections that mimic the VShell signature logic.
- Filter/Exclusion: Implement a time-based exclusion for alerts occurring between 01:00 and 04:00 local time on weekdays, specifically filtering out events where the Parent Process is falcon-sensor.exe or sentinelone-agent.exe.
Scenario: IT Admin Remote Management Sessions
- Context: System administrators frequently use remote management tools like Microsoft SCCM (Endpoint Configuration Manager) or Ivanti Neurons to push configuration updates, run PowerShell scripts, or deploy patches. These tools often spawn temporary processes that communicate with the central management server using protocols and ports