ThreatFox: VShell IOCs

Hunt Hypothesis

This detection identifies adversary activity involving specific Indicators of Compromise (IOCs) linked to the VShell remote access tool, which is frequently leveraged by threat actors to establish persistent command and control channels within compromised environments. Proactively hunting for these IOCs in Azure Sentinel enables the SOC team to rapidly detect early-stage lateral movement or unauthorized remote sessions before adversaries can fully entrench their presence on the network.

IOC Summary

Malware Family: VShell Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["180.76.105.117", "158.247.247.229", "150.158.109.234"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["180.76.105.117", "158.247.247.229", "150.158.109.234"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — VShell

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: VShell IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Automated Vulnerability Scanning by Qualys or Tenable

  • Context: Enterprise vulnerability management platforms (e.g., Qualys Cloud Agent, Tenable Nessus) frequently probe internal hosts to identify open ports and service versions. These scanners often initiate connections to known VShell endpoints (such as vshell.io or specific API gateways) to verify certificate validity or check for software updates, triggering the 3-IOC hunt logic.
  • Filter/Exclusion: Exclude network traffic originating from the IP subnets assigned to your vulnerability management servers. Additionally, add a rule exception if the destination port is 443 and the source process name matches known scanner executables (e.g., qualyspc.exe, tenable_agent.exe).

• Scenario: Scheduled Cloud Backup Jobs via Veeam or Commvault

  • Context: In many hybrid environments, backup solutions like Veeam Backup & Replication or Commvault utilize VShell as a transport layer for offsite replication. During nightly scheduled maintenance windows (e.g., 02:00–04:00), these agents establish persistent connections to the VShell gateway, generating the specific IOCs associated with data transfer and authentication handshakes.
  • Filter/Exclusion: Create a time-based exclusion window for backup execution hours. Furthermore, whitelist the specific Service Principal Account (e.g., svc-vshell-backup) or the hostnames of dedicated backup proxy servers in your SIEM correlation engine to suppress alerts during these windows.

• Scenario: Admin-Initiated Remote Management via Microsoft Endpoint Manager

  • Context: System administrators often use Microsoft Intune or Configuration