ThreatFox: VShell IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity involving known VShell indicators of compromise (IOCs) that signal potential command-and-control or lateral movement within the network. A SOC team should proactively hunt for these signals in Azure Sentinel to rapidly isolate compromised assets and prevent the spread of this specific threat before it escalates into a broader incident.

IOC Summary

Malware Family: VShell Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`101[.]42[.]249[.]98:8084`	botnet_cc	2026-08-04	100%
ip:port	`103[.]30[.]76[.]214:8779`	botnet_cc	2026-08-04	100%
ip:port	`38[.]76[.]194[.]219:8090`	botnet_cc	2026-08-04	100%
ip:port	`39[.]105[.]213[.]209:8084`	botnet_cc	2026-08-04	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["103.30.76.214", "39.105.213.209", "101.42.249.98", "38.76.194.219"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["103.30.76.214", "39.105.213.209", "101.42.249.98", "38.76.194.219"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — VShell

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: VShell IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

Scenario: Automated Patching via WSUS or SCCM
- Context: The Windows Update Services (WSUS) or Microsoft Endpoint Configuration Manager (SCCM) frequently downloads and executes VShell-related binaries during scheduled maintenance windows to update security agents. These legitimate updates often match the 4 IOCs associated with VShell deployment scripts.
- Filter/Exclusion: Create a filter that excludes alerts where the ProcessName matches wuauserv.exe, ccmexec.exe, or wsusservice.exe and the ParentProcessName is svchost.exe. Additionally, exclude events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) on servers tagged with “Patch Server” in your asset inventory.
Scenario: Third-Party Backup Solutions Running VShell Agents
- Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault often utilize the VShell agent to manage data replication and encryption keys. When these agents perform scheduled backups, they trigger network connections and file system changes that align with the VShell IOCs.
- Filter/Exclusion: Exclude alerts where the CommandLine contains keywords such as “Veeam”, “Commvault”, or “Backup” and the process path resides within known backup installation directories (e.g., C:\Program Files\Veeam\...). You can also filter by excluding specific Service Accounts used for backups, such as DOMAIN\svc-veeam-agent.
Scenario: DevOps CI/CD Pipeline Execution
- Context: In environments using Jenkins or GitLab CI runners, build agents often install