ThreatFox: VShell IOCs | SOC Hunt Feed

Hunt Hypothesis

This hypothesis posits that adversaries are actively leveraging VShell infrastructure to establish persistent command-and-control channels or exfiltrate sensitive data via known malicious indicators. Proactively hunting these specific IOCs within Azure Sentinel is critical because early identification of this high-severity activity allows the SOC team to disrupt potential lateral movement and prevent data compromise before broader network impact occurs.

IOC Summary

Malware Family: VShell Total IOCs: 9 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`160[.]202[.]238[.]114:8002`	botnet_cc	2026-06-28	100%
ip:port	`101[.]43[.]94[.]240:8084`	botnet_cc	2026-06-28	100%
ip:port	`49[.]232[.]169[.]67:80`	botnet_cc	2026-06-28	100%
ip:port	`38[.]14[.]212[.]71:19999`	botnet_cc	2026-06-27	100%
ip:port	`206[.]119[.]167[.]29:8992`	botnet_cc	2026-06-27	100%
ip:port	`45[.]76[.]145[.]175:58211`	botnet_cc	2026-06-27	100%
ip:port	`49[.]232[.]242[.]230:8084`	botnet_cc	2026-06-27	100%
ip:port	`110[.]42[.]212[.]24:6379`	botnet_cc	2026-06-27	100%
ip:port	`111[.]170[.]148[.]177:1234`	botnet_cc	2026-06-27	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["160.202.238.114", "101.43.94.240", "45.76.145.175", "38.14.212.71", "49.232.242.230", "49.232.169.67", "110.42.212.24", "206.119.167.29", "111.170.148.177"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["160.202.238.114", "101.43.94.240", "45.76.145.175", "38.14.212.71", "49.232.242.230", "49.232.169.67", "110.42.212.24", "206.119.167.29", "111.170.148.177"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — VShell

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: VShell IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Endpoint Security Agent Updates via Vendor Management Console
- Scenario: The Enterprise Endpoint Protection team (using tools like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) pushes a scheduled policy update that includes the VShell vulnerability patch. This triggers network connections to the specific VShell IOCs from all managed workstations simultaneously during the maintenance window (e.g., 2:00 AM – 4:00 AM).
- Filter/Exclusion: Create an exclusion for traffic originating from the Endpoint Management Server IP range or the specific Group Policy Object (GPO) security group. Additionally, filter alerts occurring within the defined maintenance window to prevent noise during routine patching cycles.
IT Helpdesk Remote Support Sessions
- Scenario: IT support analysts utilize remote desktop tools such as ConnectWise Control, TeamViewer, or BMC Helix Remedy to troubleshoot user workstations. During a session, the analyst’s machine or the remote agent initiates an outbound connection to VShell IOCs to verify certificate validity or check for known vulnerabilities on the target host before applying fixes.
- Filter/Exclusion: Exclude traffic where the source IP belongs to the IT Helpdesk VLAN or specific Jump Box/Bastion Host subnets. Alternatively, filter events where the process name matches known remote support executables (e.g., ConnectWise.exe, TeamViewer_Service.exe).
Automated Vulnerability Scanning and Compliance Audits
- Scenario: The security operations team runs weekly vulnerability scans using tools like Tenable Nessus, Qualys VMDR, or **Rapid