This hunt targets the presence of VShell, a lightweight remote access tool often used by adversaries to establish covert command-and-control channels or maintain persistent access to compromised systems. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify potential backdoors or unauthorized remote access mechanisms before they are leveraged for lateral movement or data exfiltration.
Malware Family: VShell Total IOCs: 6 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 192[.]210[.]197[.]13:12313 | botnet_cc | 2026-09-17 | 100% |
| ip:port | 47[.]129[.]3[.]232:4433 | botnet_cc | 2026-09-17 | 100% |
| ip:port | 185[.]193[.]126[.]143:8084 | botnet_cc | 2026-09-17 | 100% |
| ip:port | 107[.]148[.]78[.]97:9000 | botnet_cc | 2026-09-17 | 100% |
| ip:port | 124[.]222[.]77[.]67:8018 | botnet_cc | 2026-09-17 | 100% |
| ip:port | 42[.]192[.]54[.]109:8084 | botnet_cc | 2026-09-17 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["185.193.126.143", "47.129.3.232", "42.192.54.109", "192.210.197.13", "107.148.78.97", "124.222.77.67"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["185.193.126.143", "47.129.3.232", "42.192.54.109", "192.210.197.13", "107.148.78.97", "124.222.77.67"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses vshell as a lightweight, secure alternative to standard SSH for connecting to a staging Kubernetes node or a remote Linux server for debugging. The tool is installed via go install or downloaded as a binary, and its execution path or hash matches one of the ThreatFox IOCs.
cmd.exe, powershell.exe, bash, zsh) AND the user belongs to the DevOps or PlatformEngineering security group. Alternatively, allowlist the specific binary path if it resides in a standard development tool directory (e.g., C:\Users\<user>\go\bin\vshell.exe or /usr/local/bin/vshell).Scenario: An IT administrator performs a routine software inventory or vulnerability scan using a tool like Tenable.io, Qualys, or Rapid7 InsightVM. The scanner agent or a custom script downloads and executes vshell temporarily to test connectivity or gather system information on a target host, triggering the IOC match.
qualys_agent.exe, tenable_agent.exe, insightvm_agent.exe) OR where the process is executed from a temporary directory (e.g., C:\Temp\, /tmp/) and is terminated within a short timeframe (e.g., < 60 seconds).Scenario: A security team runs a YARA rule or a custom detection script that includes vshell as a test case or reference binary to validate their EDR’s file scanning capabilities. The test instance is executed in an isolated lab VM or a dedicated test account.
test,