ThreatFox: VShell IOCs

Hunt Hypothesis

This hypothesis targets the presence of VShell, a lightweight web shell often deployed by attackers to establish persistent access and execute commands on compromised Azure resources. Proactively hunting for these IOCs in Azure Sentinel is critical because VShell can operate stealthily within web applications or storage accounts, allowing adversaries to maintain footholds and escalate privileges without triggering standard network-based alerts.

IOC Summary

Malware Family: VShell Total IOCs: 9 IOC Types: sha256_hash, md5_hash, ip:port, sha1_hash

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["217.216.59.19"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["217.216.59.19"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - VShell
let malicious_hashes = dynamic(["ea61e6b052fa4f17a1611740bd510231e47da066", "64d2e47324b3bfdb6dd0c304bad76e86", "f7cf5972a76f530d6e3f603d235bb6c0", "e8e92710ead19fb9caa053c7335a6fcd8b8cd49b", "e2fe451f1dcc57c69ee6f406dba3353638974aed", "d4f5e0eabc74654b72c188d823b0a855", "578de94d85ac86958fd3cc3e2a8e7b23d5669cdf2c2d4bd1eb1519d705c0bb2b", "d5214d68cc5ae5868a32b9d01a214856f21c63077409e4b30c4a821df9917712"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — VShell

False Positive Guidance

• Scenario: A DevOps engineer uses vshell (or a similar lightweight SSH client wrapper) as a standard tool for quick ad-hoc debugging of containerized microservices in the staging environment, triggering the IOCs for known VShell binary hashes or network signatures.
  • Filter/Exclusion: Exclude processes where the parent process is docker, kubectl, or containerd-shim, or exclude network connections to internal staging subnets (e.g., 10.20.0.0/16) if the IOC is network-based.
• Scenario: A security team deploys a temporary canary token or honeypot using VShell to test endpoint detection coverage, causing the IOCs to fire on the intended test host.
  • Filter/Exclusion: Add an exclusion for hosts tagged with Environment: Canary or Tag: Honeypot in your CMDB or asset inventory, or exclude specific user accounts designated as sec-tester.
• Scenario: An automated patching script downloads a utility that shares a similar hash or filename pattern with VShell IOCs due to a generic build artifact name (e.g., vshell.exe used as a generic name for a version shell script in a custom internal tool).
  • Filter/Exclusion: Exclude processes where the executable path resides in a known internal tools directory (e.g., C:\Program Files\InternalTools\) or where the parent process is a scheduled task named Weekly-Patch-Utility.
• Scenario: A legacy application installer bundles a helper executable that matches one of the VShell IOCs (e.g., a specific SHA256 hash) but is signed by the enterprise’s internal code-signing certificate.
  • Filter/Exclusion: Exclude events where the binary is signed by the internal corporate code-signing certificate