ThreatFox: VShell IOCs

Hunt Hypothesis

This hunt targets adversaries utilizing VShell malware to establish covert command-and-control channels through specific IP:port pairs for data exfiltration. Proactively hunting these indicators in Azure Sentinel is critical to identify early-stage compromise and prevent sensitive data loss before lateral expansion occurs.

IOC Summary

Malware Family: VShell Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["132.226.72.148", "149.104.28.77"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["132.226.72.148", "149.104.28.77"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — VShell

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: VShell IOCs rule in an enterprise environment, including suggested filters or exclusions:

• Automated Software Patching and Updates

  • Scenario: Enterprise patch management tools (e.g., Microsoft SCCM, Ivanti Neurons, or WSUS) frequently initiate outbound connections to vendor update servers. If the VShell C2 IP addresses overlap with major software distribution networks, legitimate update checks for applications like Adobe Creative Cloud or Java Runtime will trigger the rule.
  • Filter/Exclusion: Create an exclusion allowing traffic from known patching service accounts (e.g., NT SERVICE\ccmexec) and specific application processes (wsusutil.exe, AdobeARM.exe) to the identified VShell IP ranges during standard maintenance windows (e.g., 02:00–06:00 local time).

• Cloud Backup and Data Synchronization Agents

  • Scenario: Background data exfiltration is a core function of backup agents. Tools like Veeam Agent, Rubrik, or Microsoft OneDrive for Business establish persistent C2-like connections to cloud storage endpoints. If the VShell detection logic flags specific ports (e.g., 443, 8080) used by these services, routine file sync operations will appear as suspicious data exfiltration.
  • Filter/Exclusion: Exclude traffic originating from backup service executables (VeeamAgent.exe, OneDrive.exe) and destination IPs belonging to known cloud storage providers (e.g., Azure Blob Storage ranges) that match the VShell port specifications.

• Scheduled Network Scanning and Asset Discovery

  • Scenario: Security operations teams often run scheduled network discovery scans using tools like SolarWinds NPM, ** Lansweeper**,