ThreatFox: VShell IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving known VShell indicators of compromise (IOCs) that may signal unauthorized access or command-and-control communications within the environment. Proactively hunting for these specific IOCs in Azure Sentinel is critical to rapidly detect and contain potential threats leveraging VShell infrastructure before they escalate into broader security incidents.

IOC Summary

Malware Family: VShell Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["106.38.201.117", "64.118.132.68"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["106.38.201.117", "64.118.132.68"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — VShell

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: VShell IOCs detection rule in an enterprise environment:

• Scenario: Automated Vulnerability Scanning by Security Operations Center (SOC)

  • Context: The organization runs nightly vulnerability scans using Tenable Nessus or Qualys. These scanners often utilize the VShell agent to query remote hosts for asset inventory and patch compliance, generating network traffic that matches VShell IOCs.
  • Filter/Exclusion: Create a rule exclusion based on the specific source IP ranges of the vulnerability scanning servers (e.g., 10.20.50.x) or exclude events where the process name is nessuscli.exe / qualyspc.exe.

• Scenario: Scheduled Group Policy Updates via Microsoft Endpoint Configuration Manager

  • Context: During business hours, Microsoft SCCM (Configuration Manager) pushes software updates and policy configurations. The VShell agent on client machines communicates with the management point to report status or download payloads, triggering the detection logic.
  • Filter/Exclusion: Exclude events occurring during defined maintenance windows (e.g., 02:00–06:00 UTC) where the parent process is ccmexec.exe and the destination port matches the SCCM management point port (typically 8531).

• Scenario: Endpoint Detection and Response (EDR) Telemetry Collection

  • Context: The enterprise utilizes CrowdStrike Falcon or Microsoft Defender for Endpoint. These EDR agents frequently query VShell IOCs to correlate threat intelligence feeds, causing legitimate internal traffic that mimics the rule’s signature.
  • Filter/Exclusion: Filter out events where the initiating process is FalconSensor.exe (CrowdStrike) or MsMpEng.exe (Def