ThreatFox: VShell IOCs

Hunt Hypothesis

This hunt targets the presence of VShell, a lightweight remote access tool frequently used by adversaries to establish persistent backdoors or execute commands on compromised hosts. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify stealthy footholds that may bypass traditional perimeter defenses, enabling rapid containment before the tool is leveraged for lateral movement or data exfiltration.

IOC Summary

Malware Family: VShell Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["124.223.57.38", "139.180.216.149"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["124.223.57.38", "139.180.216.149"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — VShell

False Positive Guidance

• Scenario: A DevOps engineer uses a standard curl or wget command to download a specific VShell binary or configuration file from a trusted internal artifact repository (e.g., Artifactory or Nexus) during a CI/CD pipeline execution.
  • Filter/Exclusion: Exclude events where the source process is curl.exe or wget.exe and the destination path resides within known build directories (e.g., C:\Jenkins\workspace\ or /home/jenkins/agent/workspace/).
• Scenario: An IT administrator manually downloads the VShell client installer from the vendor’s official portal to deploy it on a new jump host, triggering the IOC match for the known executable hash or URL.
  • Filter/Exclusion: Exclude events where the user account belongs to the IT_Admins security group and the source IP address is within the corporate management VLAN range (e.g., 10.20.0.0/24).
• Scenario: A scheduled maintenance job on a web server fetches a VShell update script from a private Git repository using git pull or svn update, which may inadvertently match a URL-based IOC if the repository path contains the specific string.
  • Filter/Exclusion: Exclude events where the parent process is git.exe or svn.exe and the working directory is located under version control system paths (e.g., C:\src\ or /var/www/html/.git/).
• Scenario: A security team runs a YARA scan or memory dump analysis using a tool like Volatility or Yara64 that loads VShell-related signatures or test binaries into memory, causing a false positive on memory-based IOCs.
  • Filter/Exclusion: Exclude events where the parent process is a known security tool (e.g., `