ThreatFox: VShell IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection identifies adversary activity involving known VShell indicators of compromise (IOCs) that may signal unauthorized access or command-and-control communication within the environment. Proactive hunting is essential to rapidly validate these specific IOCs in Azure Sentinel, ensuring early identification and containment of potential threats before they escalate into broader incidents.

IOC Summary

Malware Family: VShell Total IOCs: 7 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`117[.]72[.]41[.]61:8084`	botnet_cc	2026-08-09	100%
ip:port	`120[.]26[.]14[.]56:8084`	botnet_cc	2026-08-09	100%
ip:port	`198[.]46[.]216[.]194:8084`	botnet_cc	2026-08-09	100%
ip:port	`182[.]92[.]188[.]8:500`	botnet_cc	2026-08-09	100%
ip:port	`155[.]117[.]224[.]68:21`	botnet_cc	2026-08-09	100%
ip:port	`111[.]228[.]27[.]89:4567`	botnet_cc	2026-08-09	100%
ip:port	`43[.]142[.]109[.]146:19726`	botnet_cc	2026-08-08	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["120.26.14.56", "43.142.109.146", "117.72.41.61", "198.46.216.194", "182.92.188.8", "155.117.224.68", "111.228.27.89"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["120.26.14.56", "43.142.109.146", "117.72.41.61", "198.46.216.194", "182.92.188.8", "155.117.224.68", "111.228.27.89"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — VShell

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: VShell IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Automated Vulnerability Scanning by Qualys or Tenable
- Context: Enterprise vulnerability scanners (e.g., Qualys Cloud Agent, Tenable Nessus) frequently probe internal assets to identify open ports and service versions. These agents often initiate outbound connections to known VShell infrastructure IPs or domains to verify connectivity or check for specific CVEs associated with the VShell ecosystem.
- Filter/Exclusion: Exclude network traffic where the source host is a member of the VULN-SCANNER Active Directory group and the destination matches the specific CIDR ranges defined in the ThreatFox IOC list. Alternatively, add a filter to ignore alerts if the source process name contains qualyspc.exe or tenable-agent.
Scenario: Scheduled Backup Jobs Utilizing VShell as an Archive Target
- Context: Data protection tools like Veeam Backup & Replication or Commvault often use VShell instances as a repository target for storing backup metadata and logs. A nightly scheduled job (e.g., running at 02:00 AM via Windows Task Scheduler) may trigger connections to the VShell management interface, mimicking the behavior of an active threat.
- Filter/Exclusion: Create an exclusion rule based on time windows (e.g., 01:00 to 05:00) and process names such as VeeamTransport.exe, vbrservice.exe, or commvault.cmd. If the alert occurs during these hours from a host tagged with BACKUP-SERVER, suppress the alert.
Scenario: Admin Remote Management via PowerShell or RDP
- Context: System administrators frequently use