This rule detects the presence of VShell malware, a tool frequently used by adversaries to establish persistent backdoor access and execute remote commands on compromised hosts. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify stealthy intrusions and disrupt adversary operations before they can escalate privileges or exfiltrate sensitive data.
Malware Family: VShell Total IOCs: 8 IOC Types: ip:port, url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 115[.]190[.]170[.]185:8084 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 114[.]132[.]91[.]156:8280 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 144[.]7[.]106[.]78:8085 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 150[.]158[.]51[.]67:8083 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 42[.]193[.]169[.]176:8084 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 49[.]233[.]30[.]13:8084 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 60[.]204[.]208[.]179:32122 | botnet_cc | 2026-09-21 | 100% |
| url | hxxp://156[.]238[.]224[.]156:5522/?h=156[.]238[.]224[.]156&p=5522&t=ws&a=w64&stage=true | payload_delivery | 2026-09-21 | 95% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["42.193.169.176", "144.7.106.78", "150.158.51.67", "49.233.30.13", "60.204.208.179", "115.190.170.185", "114.132.91.156"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["42.193.169.176", "144.7.106.78", "150.158.51.67", "49.233.30.13", "60.204.208.179", "115.190.170.185", "114.132.91.156"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for access to known malicious URLs
// Source: ThreatFox - VShell
let malicious_urls = dynamic(["http://156.238.224.156:5522/?h=156.238.224.156&p=5522&t=ws&a=w64&stage=true"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
vshell_helper.py) to automate service restarts, which is copied to the C:\Users\Public\ directory and executed via a scheduled task. The script’s hash or path matches a known VShell IOc due to similar naming conventions or shared libraries.
C:\Users\Public\ if the parent process is Task Scheduler (taskschd.msi) or svchost.exe (for scheduled tasks) and the file extension is .py or .pyc.C:\Windows\Temp\ or C:\Windows\System32\ folder, which may match VShell’s file placement or service creation IOCs.
C:\Sysinternals\PsExec.exe or C:\Tools\PsExec.exe and the service name contains PSEXEC or PsExecSvc.C:\Program Files (x86)\Common Files\ and registers a service with a name similar to VShell’s known service names (e.g., VShellSvc vs. VendorShellSvc).
C:\Program Files (x86)\Common Files\ or `C:\Program Files