This hunt targets the presence of VShell, a lightweight web shell that adversaries deploy to establish persistent, covert command-and-control channels within web applications. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised web servers and uncover hidden backdoors before attackers leverage them for lateral movement or data exfiltration.
Malware Family: VShell Total IOCs: 59 IOC Types: sha256_hash, ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 154[.]91[.]62[.]101:8084 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 154[.]91[.]60[.]124:8084 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 154[.]91[.]61[.]99:8084 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 154[.]91[.]63[.]115:8084 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 154[.]91[.]60[.]123:8084 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 154[.]91[.]61[.]109:8084 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 154[.]91[.]63[.]113:8084 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 154[.]91[.]60[.]116:8084 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 154[.]91[.]60[.]98:8084 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 154[.]91[.]60[.]99:8084 | botnet_cc | 2026-09-19 | 100% |
| sha256_hash | 8b60b132edfe051a17e79883e0da471f21c50804fbb7d1b2fdbc7ed5d606d9ed | payload | 2026-09-19 | 95% |
| sha256_hash | 8b4caad4c51a87f10977d3fecd40938d5201bb9d8762a9d728c3c0454ba5e414 | payload | 2026-09-19 | 95% |
| ip:port | 154[.]91[.]60[.]113:8084 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 154[.]91[.]60[.]114:8084 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 154[.]91[.]60[.]112:8084 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 154[.]91[.]60[.]110:8084 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 154[.]91[.]60[.]108:8084 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 154[.]91[.]60[.]100:8084 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 154[.]91[.]59[.]113:8084 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 154[.]91[.]59[.]120:8084 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 154[.]91[.]59[.]122:8084 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 154[.]91[.]59[.]102:8084 | botnet_cc | 2026-09-19 | 100% |
| sha256_hash | 6451fd21e11fa85cf1c076aa00825393ba3654e492675087b8bdba8f695122b0 | payload | 2026-09-19 | 95% |
| ip:port | 154[.]91[.]59[.]105:8084 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 154[.]91[.]59[.]103:8084 | botnet_cc | 2026-09-19 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["154.91.56.110", "154.91.58.105", "154.91.60.110", "154.91.63.115", "154.91.58.107", "139.155.138.221", "154.91.61.109", "154.91.59.102", "154.91.59.122", "154.91.56.109", "154.91.61.99", "154.91.57.113", "154.91.60.124", "154.91.60.112", "154.91.60.99", "154.91.58.118", "114.215.190.164", "154.91.59.105", "154.91.58.103", "154.91.56.111", "154.91.59.120", "154.91.56.98", "154.91.59.101", "154.91.57.117", "154.91.59.103", "154.91.60.113", "45.192.213.11", "8.137.35.137", "154.91.60.116", "154.91.60.100", "154.91.58.102", "154.91.60.98", "154.91.60.123", "154.91.58.119", "154.91.62.101", "154.91.63.113", "154.91.57.109", "154.91.56.115", "114.55.170.136", "154.91.60.108", "113.45.6.129", "111.229.216.164", "154.91.59.113", "154.91.60.114", "110.173.53.99", "111.228.27.89", "66.23.197.18", "154.91.57.120"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["154.91.56.110", "154.91.58.105", "154.91.60.110", "154.91.63.115", "154.91.58.107", "139.155.138.221", "154.91.61.109", "154.91.59.102", "154.91.59.122", "154.91.56.109", "154.91.61.99", "154.91.57.113", "154.91.60.124", "154.91.60.112", "154.91.60.99", "154.91.58.118", "114.215.190.164", "154.91.59.105", "154.91.58.103", "154.91.56.111", "154.91.59.120", "154.91.56.98", "154.91.59.101", "154.91.57.117", "154.91.59.103", "154.91.60.113", "45.192.213.11", "8.137.35.137", "154.91.60.116", "154.91.60.100", "154.91.58.102", "154.91.60.98", "154.91.60.123", "154.91.58.119", "154.91.62.101", "154.91.63.113", "154.91.57.109", "154.91.56.115", "114.55.170.136", "154.91.60.108", "113.45.6.129", "111.229.216.164", "154.91.59.113", "154.91.60.114", "110.173.53.99", "111.228.27.89", "66.23.197.18", "154.91.57.120"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - VShell
let malicious_hashes = dynamic(["8b60b132edfe051a17e79883e0da471f21c50804fbb7d1b2fdbc7ed5d606d9ed", "8b4caad4c51a87f10977d3fecd40938d5201bb9d8762a9d728c3c0454ba5e414", "6451fd21e11fa85cf1c076aa00825393ba3654e492675087b8bdba8f695122b0", "214ab25a265b929cb3a4d4efda395773a87ad0ab0e81fda15c361116921b3f69", "4eb12aef549c5c5ef491ebdfe976181e1abbbb922d369f2457f099b8cfbe71e6", "332d5b8d228dd3bd8fbae99f6408cdfd424f5e48d7c71b054af84d1df414c94d", "1f08e8d9dd5374a4df8ae963daf20928faaeee5985eed99cb741f89fafce62fa", "f48801ccbac2ccffdcc6b68db1ae21d35fad179630d5af968a0983af10a5da7b", "3daf295e54b996fd0b9ed3270b03381fc8066ea32a4ead4e454058f3aab771b4", "5928481fada1e9be6582b365b7effa977dc43ebf7f9e0a386f485649b30690ec", "8d06ef4fd7819b75943dec120fbd50c1fd0820c760734fa13f7ffa6fac85d1d9"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceFileEvents | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses a custom Python script to perform automated health checks on internal microservices, where the script explicitly references the vshell binary name or path as part of a compatibility shim or legacy wrapper for an older monitoring agent.
C:\Program Files\MonitoringTools\agents\vshell.exe or C:\Scripts\health_check\compat_vshell.py and the parent process is python.exe or pwsh.exe.Scenario: An IT administrator performs a manual vulnerability assessment using a commercial endpoint detection tool (e.g., CrowdStrike Falcon or Carbon Black) that includes a module named vshell for verifying shell access permissions on domain controllers.
FalconSensor.exe, cb.exe) and the user account belongs to the IT-Admins or Security-Team security group.Scenario: A software development team builds a local development environment using Docker Compose, where a container image for a legacy Java application includes a startup script that invokes a utility binary named vshell to initialize virtual shell environments for testing.
\docker\ or \containerd\ and the user account is docker-service or build-agent.Scenario: A system administrator runs a scheduled PowerShell job to clean up temporary files, which inadvertently matches an IOC string if the cleanup script uses a variable name or log tag containing “vshell” (e.g., $vshellTempDir) that gets captured in the event log.