ThreatFox: VShell IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection identifies adversary activity involving four specific indicators of compromise linked to the VShell remote access tool, which is frequently leveraged by threat actors for lateral movement and persistent command execution. Proactively hunting for these IOCs within Azure Sentinel is critical to rapidly uncover stealthy post-compromise sessions that may evade standard signature-based defenses and prevent unauthorized system control.

IOC Summary

Malware Family: VShell Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`47[.]97[.]197[.]89:40000`	botnet_cc	2026-07-25	100%
ip:port	`149[.]62[.]46[.]110:8085`	botnet_cc	2026-07-25	100%
ip:port	`119[.]29[.]5[.]85:10443`	botnet_cc	2026-07-25	100%
ip:port	`47[.]102[.]200[.]89:8084`	botnet_cc	2026-07-25	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["47.97.197.89", "119.29.5.85", "47.102.200.89", "149.62.46.110"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["47.97.197.89", "119.29.5.85", "47.102.200.89", "149.62.46.110"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — VShell

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: VShell IOCs detection rule, along with targeted filters or exclusions to mitigate noise in an enterprise environment:

Scenario: Enterprise Antivirus Scheduled Scans
- Context: The organization uses CrowdStrike Falcon or Microsoft Defender for Endpoint (MDE) which performs nightly deep scans. These agents often generate network traffic and file hashes that match the VShell IOCs because the antivirus engine itself utilizes similar shell components or proxies to fetch threat intelligence updates, mimicking the behavior of a compromised host running VShell.
- Filter/Exclusion: Exclude alerts where the source process is falconagent.exe (CrowdStrike) or MsMpEng.exe (MDE) and the event timestamp falls within the defined maintenance window (e.g., 02:00–04:00 UTC).
Scenario: DevOps CI/CD Pipeline Artifacts
- Context: The internal Jenkins or GitLab Runner nodes frequently pull container images and build artifacts from the company’s private artifact repository (e.g., Harbor or Nexus). These repositories often host VShell-related security tools or documentation, causing the CI/CD agents to generate network connections and file downloads that trigger all four IOCs simultaneously.
- Filter/Exclusion: Create a whitelist for the specific IP ranges of the CI/CD infrastructure (e.g., 10.20.30.0/24) or exclude alerts where the source hostname contains keywords like “jenkins-node” or “gitlab-runner”.
Scenario: Third-Party Patch Management Deployments
- Context: The IT operations team utilizes Ivanti Neurons or Microsoft SCCM (Endpoint Configuration Manager) to deploy