ThreatFox: VShell IOCs | SOC Hunt Feed

Hunt Hypothesis

This rule detects the presence of VShell, a lightweight web shell often deployed by adversaries to establish persistent access and execute commands on compromised Azure resources. Proactively hunting for these IOCs allows the SOC team to identify stealthy backdoors that may have been introduced through initial access vectors, enabling rapid containment before the adversary leverages the web shell for lateral movement or data exfiltration.

IOC Summary

Malware Family: VShell Total IOCs: 12 IOC Types: ip:port, sha256_hash, url

Type	Value	Threat Type	First Seen	Confidence
ip:port	`139[.]155[.]42[.]198:8089`	botnet_cc	2026-09-22	100%
ip:port	`207[.]57[.]125[.]216:8084`	botnet_cc	2026-09-22	100%
url	`hxxp://154[.]91[.]180[.]246:18080/?h=154[.]91[.]180[.]246&p=18080&t=tcp&a=w32&stage=true`	payload_delivery	2026-09-22	100%
url	`hxxp://154[.]91[.]180[.]246:18082/?h=154[.]91[.]180[.]246&p=18082&t=ws&a=w64&stage=true`	payload_delivery	2026-09-22	95%
sha256_hash	`f813d309920d6109c1bfe88f1020d44814123e884a6a9fdb9bccb8a406c799cc`	payload	2026-09-22	95%
sha256_hash	`c062ac021106deaecc4902203a323946e4ffc38644ebe68c263931739cd42a1c`	payload	2026-09-22	95%
sha256_hash	`9727349443f01a5698c04810ff940ce90efa02421c375c6cff728fa4468a5214`	payload	2026-09-22	95%
sha256_hash	`ebfbdb9ee02f74d2734b3b3c57afeed7a02c8dd12d07b3a9ab14d3ce81511cc3`	payload	2026-09-22	95%
sha256_hash	`b63e4c97c1a2fe872f82f781dfa4179d200ff4e0ec6e650dc1e42134f38903b3`	payload	2026-09-22	95%
url	`hxxp://154[.]91[.]180[.]246:18080/?h=154[.]91[.]180[.]246&p=18080&t=ws&a=w64&stage=true`	payload_delivery	2026-09-22	95%
url	`hxxp://154[.]91[.]180[.]246:18081/?h=154[.]91[.]180[.]246&p=18081&t=tcp&a=w64&stage=true`	payload_delivery	2026-09-22	95%
url	`hxxp://154[.]91[.]180[.]246:18082/?h=154[.]91[.]180[.]246&p=18082&t=tcp&a=w64&stage=true`	payload_delivery	2026-09-22	95%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["139.155.42.198", "207.57.125.216"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["139.155.42.198", "207.57.125.216"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - VShell
let malicious_urls = dynamic(["http://154.91.180.246:18080/?h=154.91.180.246&p=18080&t=tcp&a=w32&stage=true", "http://154.91.180.246:18082/?h=154.91.180.246&p=18082&t=ws&a=w64&stage=true", "http://154.91.180.246:18080/?h=154.91.180.246&p=18080&t=ws&a=w64&stage=true", "http://154.91.180.246:18081/?h=154.91.180.246&p=18081&t=tcp&a=w64&stage=true", "http://154.91.180.246:18082/?h=154.91.180.246&p=18082&t=tcp&a=w64&stage=true"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - VShell
let malicious_hashes = dynamic(["f813d309920d6109c1bfe88f1020d44814123e884a6a9fdb9bccb8a406c799cc", "c062ac021106deaecc4902203a323946e4ffc38644ebe68c263931739cd42a1c", "9727349443f01a5698c04810ff940ce90efa02421c375c6cff728fa4468a5214", "ebfbdb9ee02f74d2734b3b3c57afeed7a02c8dd12d07b3a9ab14d3ce81511cc3", "b63e4c97c1a2fe872f82f781dfa4179d200ff4e0ec6e650dc1e42134f38903b3"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceFileEvents`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — VShell

False Positive Guidance

Scenario: A DevOps engineer uses vshell as a lightweight, non-interactive SSH alternative for quick ad-hoc command execution on a Linux jump host, bypassing the standard ssh client due to a temporary network configuration issue.
- Filter/Exclusion: Exclude alerts where the process parent is a known interactive shell (e.g., bash, zsh) or tmux/screen sessions, and restrict the user context to specific service accounts or developers with dev-jump group membership.
Scenario: An automated CI/CD pipeline step on a build agent executes a custom script that invokes vshell to run a remote health check or log collection task on a staging server, using a dedicated ci-runner service account.
- Filter/Exclusion: Exclude processes where the parent executable is a known CI/CD agent binary (e.g., jenkins, gitlab-runner, azure-pipelines-agent) or where the user is a non-interactive service account like svc-ci or build-agent.
Scenario: A system administrator performs a manual disk cleanup or log rotation on a legacy application server using a custom wrapper script that calls vshell to execute rm or find commands, as the standard ssh client has a known bug with specific key exchange algorithms on that host.
- Filter/Exclusion: Exclude alerts where the command line contains common maintenance verbs (e.g., rm, find, du, df) and the user belongs to the admin-legacy or ops-maintenance AD group, provided the target host is in the legacy-apps subnet.
Scenario: A security team runs a periodic vulnerability scan or configuration audit using a custom Python script that spawns vshell to gather sshd version