ThreatFox: VShell IOCs

Hunt Hypothesis

This detection identifies adversary activity involving specific indicators of compromise (IOCs) linked to the VShell threat actor, signaling potential reconnaissance or lateral movement within the environment. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification of VShell’s unique signatures enables rapid containment before the adversary establishes a persistent foothold or exfiltrates sensitive data.

IOC Summary

Malware Family: VShell Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["156.245.207.25", "43.139.108.161"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["156.245.207.25", "43.139.108.161"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — VShell

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: VShell IOCs detection rule, including targeted filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Vulnerability Scanning by Qualys or Tenable

  • Context: Enterprise vulnerability scanners (e.g., Qualys Cloud Agent, Tenable Nessus) frequently probe internal hosts to identify open ports and running services. These agents often initiate outbound connections to external update servers or cloud repositories that share IP ranges or domain patterns with the VShell IOCs, triggering the hunt package.
  • Filter/Exclusion: Create a rule exclusion for traffic originating from known scanner agent processes (e.g., qualyspc.exe, tenable_agent_service.exe) connecting to specific trusted IP CIDR blocks used by the scanning vendor’s update infrastructure.

• Scenario: Scheduled PowerShell Script Execution via Task Scheduler

  • Context: IT Operations teams often deploy scheduled tasks using Windows Task Scheduler to run custom PowerShell scripts for patch management or inventory collection. If these scripts utilize Invoke-RestMethod or WebRequest cmdlets to fetch data from a third-party API that hosts the VShell IOCs, the detection logic will flag these legitimate script executions as potential threats.
  • Filter/Exclusion: Exclude alerts where the parent process is identified as powershell.exe (or pwsh.exe) running under a specific administrative service account (e.g., DOMAIN\svc-patch-mgmt) and the execution path matches the known directory of scheduled scripts (e.g., C:\Scripts\Patches\).

• Scenario: Endpoint Detection and Response (EDR) Telemetry Uploads

  • Context: Modern EDR solutions like CrowdStrike Falcon or Microsoft Defender for Endpoint maintain persistent communication with their cloud management consoles. If the VShell IOCs overlap with the telemetry ingestion endpoints