ThreatFox: VShell IOCs

Hunt Hypothesis

This hunt targets the presence of VShell, a lightweight reverse shell tool frequently used by adversaries to establish covert command-and-control channels or execute post-exploitation actions. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised endpoints or suspicious network connections before the attacker can fully leverage the tool for lateral movement or data exfiltration.

IOC Summary

Malware Family: VShell Total IOCs: 7 IOC Types: sha256_hash, url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - VShell
let malicious_urls = dynamic(["http://154.211.92.190:8084/?h=154.211.92.190&p=8084&t=ws&a=w64&stage=true", "http://154.211.92.190:8084/?h=154.211.92.190&p=8084&t=tcp&a=w32&stage=true", "http://156.251.16.131:8084/?h=156.251.16.131&p=8084&t=tcp&a=w64&stage=true"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - VShell
let malicious_hashes = dynamic(["5a0dd3f6a6218f31af85fbdc1a276bc8d587d4a190c9d1457c18223b2faf1308", "03df04299cc3d2b5ce3b87f4369690f3721e152abc4f173d2dbd65c0e797c697", "e70ccc297a10f6c7b1ed610d42ad089c9a322824a2f2ce0e06bf5382c0ce81da", "e08d62943df1d69416e4a0511a157b1b994577f86a05fb8de4e8f7cb5ece09b3"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — VShell

False Positive Guidance

• Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., Jenkins or GitHub Actions) to deploy a lightweight monitoring agent that includes a static binary of VShell for ephemeral debugging sessions. The binary is executed from a temporary directory (/tmp or C:\Windows\Temp) and matches the hash or file path IOCs.

  • Filter/Exclusion: Exclude executions where the parent process is a known CI/CD runner (e.g., java.exe for Jenkins, node.exe for GitHub Actions) or where the file path contains \.github\workflows\ or jenkins\workspace\.

• Scenario: An IT administrator runs a scheduled PowerShell script to audit endpoint security tools. The script downloads a specific version of VShell from an internal artifact repository (e.g., Artifactory or Nexus) to verify its presence or behavior in a test VM. The download and execution match the network connection or file creation IOCs.

  • Filter/Exclusion: Exclude events where the source IP is within the internal artifact repository subnet (e.g., 10.20.0.0/24) and the destination path is under a designated audit directory (e.g., C:\Audit\VShellTest\).

• Scenario: A security team conducts a red team exercise or purple team drill, intentionally deploying VShell on a subset of non-production hosts to test detection coverage. The execution is expected and documented in the change management system.

  • Filter/Exclusion: Exclude hosts tagged with a specific AD group or computer object attribute (e.g., RedTeamTestGroup or PurpleTeamLab) or exclude executions where the parent process is a known red team tooling wrapper (e.g., CobaltStrike.exe or Beacon.exe).

• Scenario: A legacy application or third-party plugin