ThreatFox: VShell IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity by matching network and endpoint telemetry against twelve specific Indicators of Compromise (IOCs) linked to the VShell threat actor. A proactive hunt is essential in Azure Sentinel because early identification of these IOCs enables rapid containment of potential lateral movement or data exfiltration before the adversary establishes a persistent foothold within the environment.

IOC Summary

Malware Family: VShell Total IOCs: 12 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`47[.]116[.]219[.]137:1234`	botnet_cc	2026-07-26	100%
ip:port	`60[.]185[.]75[.]131:8084`	botnet_cc	2026-07-26	100%
ip:port	`23[.]95[.]14[.]48:60001`	botnet_cc	2026-07-26	100%
ip:port	`42[.]192[.]214[.]157:8084`	botnet_cc	2026-07-26	100%
ip:port	`23[.]95[.]14[.]48:60002`	botnet_cc	2026-07-26	100%
ip:port	`143[.]92[.]51[.]145:8084`	botnet_cc	2026-07-26	100%
ip:port	`154[.]213[.]178[.]201:8084`	botnet_cc	2026-07-26	100%
ip:port	`117[.]72[.]50[.]18:8085`	botnet_cc	2026-07-26	100%
ip:port	`206[.]119[.]165[.]12:8080`	botnet_cc	2026-07-26	100%
ip:port	`38[.]54[.]119[.]24:8080`	botnet_cc	2026-07-26	100%
ip:port	`209[.]141[.]51[.]42:18886`	botnet_cc	2026-07-26	100%
ip:port	`206[.]119[.]165[.]25:8080`	botnet_cc	2026-07-26	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["209.141.51.42", "206.119.165.25", "23.95.14.48", "60.185.75.131", "206.119.165.12", "143.92.51.145", "117.72.50.18", "47.116.219.137", "38.54.119.24", "42.192.214.157", "154.213.178.201"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["209.141.51.42", "206.119.165.25", "23.95.14.48", "60.185.75.131", "206.119.165.12", "143.92.51.145", "117.72.50.18", "47.116.219.137", "38.54.119.24", "42.192.214.157", "154.213.178.201"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — VShell

False Positive Guidance

Here are 4 specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: VShell IOCs detection rule in an enterprise environment:

Scenario: Automated Endpoint Management Scans
- Context: Enterprise endpoint management tools like Microsoft Intune, Tanium, or CrowdStrike Falcon frequently perform scheduled health checks and inventory scans. These agents often download configuration manifests, policy updates, or threat intelligence feeds from the same cloud infrastructure used by VShell, triggering matches on specific IP addresses or hash values within the 12 IOCs.
- Filter/Exclusion: Create a logic exclusion that suppresses alerts where the source process is CmAgent.exe (Tanium), IntuneManagementExtension.exe, or FalconSensorService.exe. Additionally, exclude traffic originating from known internal management subnets (e.g., 10.20.x.x/24) during standard business hours (08:00–18:00).
Scenario: Legacy Application Patching via Scheduled Tasks
- Context: IT operations teams often utilize Windows Task Scheduler to run nightly patching scripts for legacy applications. These scripts may invoke PowerShell or Python runners that connect to external repositories to fetch updates. If the repository shares a CDN or IP range with VShell’s infrastructure, the connection will trigger the rule even though it is a benign administrative task.
- Filter/Exclusion: Implement an exclusion based on the Process Name and Command Line. Filter out alerts where the process name matches powershell.exe or python.exe AND the command line contains keywords like “patching,” “update,” or specific internal script paths (e.g., \Scripts\NightlyPatch.ps1).
Scenario: Cloud Backup and Archiving Workflows
- Context: Enterprise backup solutions