This detection rule identifies adversary activity involving known VShell indicators of compromise (IOCs) to uncover potential command and control or data exfiltration efforts within the Azure Sentinel environment. Proactively hunting for these specific IOCs is critical because VShell is frequently leveraged by threat actors to establish persistent access, allowing the SOC team to rapidly isolate compromised endpoints before lateral movement occurs.
Malware Family: VShell Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 38[.]60[.]242[.]230:80 | botnet_cc | 2026-07-28 | 100% |
| ip:port | 110[.]42[.]189[.]130:8085 | botnet_cc | 2026-07-28 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["110.42.189.130", "38.60.242.230"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["110.42.189.130", "38.60.242.230"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding filters for the ThreatFox: VShell IOCs detection rule in an enterprise environment:
Scenario: The organization utilizes Veeam Backup & Replication, which includes a component named “VShell” or similar virtualization management agents that periodically scan endpoints. These agents often generate network traffic and file system artifacts matching the VShell IOCs during scheduled backup windows, triggering alerts on multiple servers simultaneously.
vbr.exe (Veeam Backup & Replication) or specific Service Account names (e.g., DOMAIN\VeeamBackupSvc). Additionally, suppress alerts originating from IP ranges dedicated to backup infrastructure during standard maintenance windows (e.g., 02:00–06:00 UTC).Scenario: IT administrators perform routine patch management using Microsoft Endpoint Configuration Manager (SCCM) or Intune, which deploys a virtualization agent update package containing VShell components. During the deployment phase, the installer creates temporary files and registry keys that match the detection logic before the service fully stabilizes.
ccmsetup.exe (SCCM) or Microsoft.IntuneManagementAgent. Furthermore, add an exclusion for specific Hash Values of known good installer packages used in the current quarter’s deployment cycle.Scenario: The enterprise runs a Citrix Virtual Apps and Desktops environment where the “VShell” component is part of the standard XenApp/XenDesktop delivery controller stack. Scheduled jobs run nightly to synchronize user profiles and update virtual desktop configurations, generating IOCs that mimic threat signatures.