ThreatFox: VShell IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection identifies adversary activity involving four specific indicators of compromise (IOCs) linked to the VShell remote access tool, which is frequently leveraged by threat actors for command and control or lateral movement. A proactive hunt in Azure Sentinel is essential to uncover early-stage infections and potential unauthorized access that may evade standard signature-based defenses before they escalate into broader network compromises.

IOC Summary

Malware Family: VShell Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`45[.]192[.]213[.]11:8085`	botnet_cc	2026-07-29	100%
ip:port	`35[.]209[.]74[.]6:8083`	botnet_cc	2026-07-29	100%
ip:port	`58[.]87[.]65[.]43:8084`	botnet_cc	2026-07-29	100%
ip:port	`206[.]238[.]68[.]19:8084`	botnet_cc	2026-07-29	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["45.192.213.11", "35.209.74.6", "206.238.68.19", "58.87.65.43"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.192.213.11", "35.209.74.6", "206.238.68.19", "58.87.65.43"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — VShell

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: VShell IOCs detection rule, including targeted filters and exclusions tailored for an enterprise environment:

Scheduled Endpoint Protection Updates via VShell Agent
- Scenario: The enterprise’s managed endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender) utilizes the VShell agent to push daily configuration updates. During the scheduled maintenance window, the agent generates network traffic matching the 4 specific IOCs defined in the rule while communicating with the central management server.
- Filter/Exclusion: Create a time-based exclusion for the detection logic to suppress alerts during the defined maintenance window (e.g., 02:00 – 04:00 UTC). Alternatively, exclude traffic originating from the specific IP address range of the Endpoint Management Server (e.g., Source_IP = 10.50.10.0/24) when the destination matches the known VShell update server domain.
Legacy Application Deployment via PowerShell Scripts
- Scenario: A DevOps team executes a nightly deployment script using PowerShell to provision legacy applications on virtual machines. The script invokes the VShell CLI tool to verify container integrity before deployment, triggering all 4 IOCs as part of the standard validation handshake.
- Filter/Exclusion: Implement an exclusion based on the process name and command line arguments. Filter out alerts where the parent process is PowerShell.exe or wscript.exe AND the command line contains specific keywords like --validate or -deployment-mode.
Internal Security Audit Scans by Qualys
- Scenario: The internal vulnerability management platform (e.g., Qualys Cloud Agent) performs periodic compliance scans that include a deep inspection of containerized services. During these scans, the agent interacts with VShell components to retrieve asset