ThreatFox: VShell IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity involving specific indicators of compromise (IOCs) linked to the VShell threat actor, which is known for targeting enterprise environments through advanced persistent threats. Proactively hunting for these IOCs within Azure Sentinel allows the SOC team to rapidly detect early-stage intrusions and mitigate potential lateral movement before attackers can establish a foothold in critical systems.

IOC Summary

Malware Family: VShell Total IOCs: 7 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`42[.]51[.]45[.]122:8090`	botnet_cc	2026-08-08	100%
ip:port	`206[.]238[.]68[.]19:8085`	botnet_cc	2026-08-08	100%
ip:port	`124[.]221[.]92[.]3:8085`	botnet_cc	2026-08-08	100%
ip:port	`134[.]122[.]177[.]37:8084`	botnet_cc	2026-08-08	100%
ip:port	`139[.]224[.]204[.]211:8443`	botnet_cc	2026-08-08	100%
ip:port	`47[.]95[.]194[.]145:9000`	botnet_cc	2026-08-08	100%
ip:port	`47[.]108[.]65[.]230:4433`	botnet_cc	2026-08-08	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["124.221.92.3", "134.122.177.37", "47.95.194.145", "47.108.65.230", "206.238.68.19", "42.51.45.122", "139.224.204.211"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["124.221.92.3", "134.122.177.37", "47.95.194.145", "47.108.65.230", "206.238.68.19", "42.51.45.122", "139.224.204.211"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — VShell

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: VShell IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

Scenario: Automated Security Scanning by EDR Agents
- Context: Enterprise Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne frequently perform background telemetry collection. These agents often spawn child processes that query the VShell infrastructure to validate agent health, update signatures, or synchronize threat intelligence feeds, triggering the 7 IOCs associated with VShell network traffic or process execution.
- Suggested Filter: Exclude alerts where the parent process is a known EDR service (e.g., FalconSensor.exe, MsMpEng.exe, SentinelOneAgent.exe) and the user context is SYSTEM or a dedicated security service account (e.g., svc-edr-sync).
Scenario: Scheduled Backup and Archiving Jobs
- Context: Enterprise backup solutions such as Veeam Backup & Replication, Commvault, or Rubrik often utilize VShell components to manage repository connectivity or perform integrity checks on stored virtual machines. During nightly scheduled jobs (e.g., running at 02:00 AM via Windows Task Scheduler), these tools initiate connections that match the VShell IOCs, specifically regarding data transfer and authentication handshakes.
- Suggested Filter: Create a time-based exclusion for alerts occurring between 01:00 and 04:00 on weekdays where the source host is identified as a backup server (e.g., SRV-BACKUP-01) and the process name contains keywords like vbr.exe, commvault_agent, or rubrik-agent.
Scenario: IT Administration via Remote Management Tools