ThreatFox: VShell IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity by correlating five specific Indicators of Compromise (IOCs) linked to the VShell threat intelligence feed, signaling potential malicious network or host interactions. A proactive hunt for these IOCs within Azure Sentinel is essential to rapidly uncover early-stage compromises and validate the presence of known threats before they escalate into significant incidents.

IOC Summary

Malware Family: VShell Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`47[.]239[.]94[.]101:8084`	botnet_cc	2026-08-02	100%
ip:port	`113[.]45[.]224[.]122:16688`	botnet_cc	2026-08-02	100%
ip:port	`150[.]158[.]30[.]251:18084`	botnet_cc	2026-08-02	100%
ip:port	`38[.]76[.]194[.]219:8081`	botnet_cc	2026-08-02	100%
ip:port	`117[.]72[.]125[.]206:8888`	botnet_cc	2026-08-02	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["113.45.224.122", "150.158.30.251", "38.76.194.219", "47.239.94.101", "117.72.125.206"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["113.45.224.122", "150.158.30.251", "38.76.194.219", "47.239.94.101", "117.72.125.206"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — VShell

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: VShell IOCs detection rule, including tailored filters and exclusions suitable for an enterprise environment:

Scenario: Security Team Manual Threat Hunting
- Context: The internal Security Operations Center (SOC) analysts frequently use the VShell platform to manually investigate alerts or extract indicators of compromise (IOCs) during incident response. When they query the VShell API or upload threat feeds, the system generates network traffic matching the rule’s 5 IOCs.
- Filter/Exclusion: Create a whitelist exclusion for source IP addresses belonging to the SOC Workstation VLAN and specific service accounts (e.g., svc-threat-hunt, soc-analyst-01). Additionally, filter out events where the user agent string contains “ThreatHuntingTool” or originates from internal subnets designated as 10.50.x.x.
Scenario: Scheduled Threat Intelligence Ingestion Job
- Context: The enterprise runs a nightly automated job using Tenable.io or CrowdStrike Falcon to ingest external threat intelligence feeds into the VShell database. This scheduled task triggers connections that match the VShell IOCs exactly, occurring daily at 02:00 UTC.
- Filter/Exclusion: Implement a time-based suppression rule that excludes alerts generated between 01:30 and 02:45 UTC on weekdays for the specific process name vshell-ingestion-service.exe. Alternatively, exclude traffic originating from the dedicated Backup & Integration Server (e.g., srv-intel-01) which hosts this scheduled job.
Scenario: DevOps CI/CD Pipeline Validation
- Context: The DevOps team utilizes VShell as a security gate in their Jenkins or **Git