ThreatFox: VShell IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity involving specific indicators of compromise (IOCs) linked to the VShell threat, which often signifies targeted reconnaissance or command-and-control operations within the network. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification of VShell-related artifacts enables rapid containment before adversaries can establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: VShell Total IOCs: 11 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`149[.]28[.]135[.]144:33389`	botnet_cc	2026-07-22	100%
ip:port	`156[.]245[.]207[.]25:8081`	botnet_cc	2026-07-22	100%
ip:port	`207[.]57[.]121[.]71:9443`	botnet_cc	2026-07-22	100%
ip:port	`117[.]72[.]60[.]242:8084`	botnet_cc	2026-07-22	100%
ip:port	`43[.]131[.]251[.]190:8084`	botnet_cc	2026-07-22	100%
ip:port	`42[.]193[.]201[.]58:8084`	botnet_cc	2026-07-22	100%
ip:port	`64[.]111[.]93[.]243:8443`	botnet_cc	2026-07-22	100%
ip:port	`115[.]190[.]237[.]175:8085`	botnet_cc	2026-07-22	100%
ip:port	`47[.]111[.]230[.]105:5000`	botnet_cc	2026-07-22	100%
ip:port	`47[.]98[.]56[.]18:8084`	botnet_cc	2026-07-22	100%
ip:port	`85[.]137[.]241[.]101:8888`	botnet_cc	2026-07-22	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["149.28.135.144", "64.111.93.243", "207.57.121.71", "117.72.60.242", "43.131.251.190", "115.190.237.175", "47.111.230.105", "42.193.201.58", "47.98.56.18", "156.245.207.25", "85.137.241.101"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["149.28.135.144", "64.111.93.243", "207.57.121.71", "117.72.60.242", "43.131.251.190", "115.190.237.175", "47.111.230.105", "42.193.201.58", "47.98.56.18", "156.245.207.25", "85.137.241.101"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — VShell

False Positive Guidance

False Positive Scenarios for “ThreatFox: VShell IOCs” Rule

Scenario: Automated Backup and Archiving via Enterprise Tools
- Context: Scheduled backup jobs using enterprise-grade agents (e.g., Veeam, Commvault, or Rubrik) often generate network traffic to external storage gateways that match the VShell IOCs. These agents may utilize similar port ranges or certificate fingerprints during data synchronization windows.
- Filter/Exclusion: Create a whitelist for the specific hostnames and IP addresses of known backup appliances (e.g., veeam-enterprise.local, 10.20.30.45) and exclude traffic originating from the “Backup” service account or specific scheduled task IDs during maintenance windows (e.g., 02:00–06:00 local time).
Scenario: Legitimate Remote Administration by IT Operations
- Context: System administrators performing routine remote management tasks using tools like Microsoft Endpoint Configuration Manager (MECM) or Ansible Tower may initiate connections to the VShell infrastructure. These sessions often involve script execution and file transfers that mimic the IOCs associated with the threat signature.
- Filter/Exclusion: Implement an exclusion based on the source user principal name (UPN) for known admin groups (e.g., CN=IT_Ops_Admin,OU=Groups) and filter out connections where the destination port is explicitly used for administrative protocols (e.g., Port 443 with specific SNI patterns matching internal management domains).
Scenario: Third-Party Cloud Integration Services
- Context: Enterprise environments often integrate with cloud-based security or analytics platforms (such as Splunk, CrowdStrike Falcon, or ServiceNow) that communicate with VShell endpoints for telemetry ingestion. These services may share overlapping IP