ThreatFox: VShell IOCs | SOC Hunt Feed

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging VShell infrastructure to conduct covert command-and-control operations or data exfiltration using known indicators of compromise. Proactively hunting these specific IOCs within Azure Sentinel is critical to rapidly identify early-stage intrusions and mitigate potential lateral movement before the adversary establishes a persistent foothold in the environment.

IOC Summary

Malware Family: VShell Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`66[.]179[.]31[.]4:80`	botnet_cc	2026-07-07	100%
ip:port	`118[.]24[.]77[.]38:10001`	botnet_cc	2026-07-07	100%
ip:port	`43[.]139[.]191[.]248:8085`	botnet_cc	2026-07-07	100%
ip:port	`115[.]190[.]209[.]209:10443`	botnet_cc	2026-07-07	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["118.24.77.38", "43.139.191.248", "115.190.209.209", "66.179.31.4"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["118.24.77.38", "43.139.191.248", "115.190.209.209", "66.179.31.4"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — VShell

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: VShell IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Endpoint Protection Management Console Updates
- Scenario: The centralized management server (e.g., CrowdStrike Falcon, SentinelOne Singularity, or Microsoft Defender for Endpoint) automatically pushes a configuration update or policy change to the “VShell” virtualization layer agents. This triggers network connections from the management console IP to the VShell agent IPs, matching the rule’s IOCs during scheduled maintenance windows (e.g., Sundays at 2:00 AM).
- Filter/Exclusion: Exclude traffic where the source IP belongs to the Endpoint_Mgmt_Server subnet and the destination port is restricted to known management ports (e.g., TCP 8443, 9001) during defined maintenance windows.
Scheduled Backup Jobs for Virtualized Assets
- Scenario: A scheduled backup job using Veeam Backup & Replication or Commvault initiates a snapshot of the VShell virtual machines. The backup proxy connects to the VShell management interface to verify integrity before creating the image, generating network flows that match the specific IOCs associated with VShell health checks and data transfer.
- Filter/Exclusion: Create an exclusion for source IPs identified as Backup_Proxy_Cluster communicating with destination IPs tagged as VShell_VM_Group, specifically filtering out traffic occurring between 01:00 and 05:00 local time.
Automated Patch Management Deployment
- Scenario: The IT operations team uses a tool like Ivanti Neurons, SCCM (Microsoft Endpoint Configuration Manager), or Ansible Tower to deploy security patches to the VShell infrastructure. During the