ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of Cobalt Strike beacons by matching network traffic and host artifacts against a curated set of 17 known indicators of compromise. Proactively hunting for these specific IOCs within Azure Sentinel is critical to rapidly identify active command-and-control communications or lateral movement attempts before they escalate into full-scale breaches.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 17 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	45[.]32[.]253[.]166:8088	botnet_cc	2026-07-12	100%
ip:port	121[.]4[.]76[.]54:8888	botnet_cc	2026-07-12	100%
ip:port	120[.]26[.]244[.]247:10000	botnet_cc	2026-07-12	100%
ip:port	47[.]113[.]98[.]42:4443	botnet_cc	2026-07-12	100%
ip:port	196[.]251[.]121[.]183:8080	botnet_cc	2026-07-12	100%
ip:port	82[.]156[.]139[.]85:8080	botnet_cc	2026-07-12	100%
ip:port	82[.]156[.]139[.]85:443	botnet_cc	2026-07-12	100%
ip:port	82[.]156[.]139[.]85:80	botnet_cc	2026-07-12	100%
ip:port	82[.]156[.]139[.]85:81	botnet_cc	2026-07-12	100%
ip:port	196[.]251[.]121[.]183:80	botnet_cc	2026-07-12	100%
ip:port	196[.]251[.]121[.]183:443	botnet_cc	2026-07-12	100%
ip:port	106[.]13[.]74[.]185:443	botnet_cc	2026-07-12	100%
ip:port	139[.]155[.]157[.]79:80	botnet_cc	2026-07-12	100%
ip:port	106[.]13[.]74[.]185:80	botnet_cc	2026-07-12	100%
ip:port	106[.]13[.]74[.]185:8080	botnet_cc	2026-07-12	100%
ip:port	139[.]155[.]157[.]79:8080	botnet_cc	2026-07-12	100%
ip:port	186[.]241[.]75[.]134:80	botnet_cc	2026-07-11	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["106.13.74.185", "47.113.98.42", "139.155.157.79", "45.32.253.166", "82.156.139.85", "196.251.121.183", "121.4.76.54", "120.26.244.247", "186.241.75.134"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["106.13.74.185", "47.113.98.42", "139.155.157.79", "45.32.253.166", "82.156.139.85", "196.251.121.183", "121.4.76.54", "120.26.244.247", "186.241.75.134"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
CommonSecurityLog	Ensure this data connector is enabled
DeviceNetworkEvents	Ensure this data connector is enabled

References

• ThreatFox — Cobalt Strike

False Positive Guidance

Here are four specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Scanning of Developer Artifacts

  • Scenario: Security teams often utilize Cobalt Strike (CS) Beacon binaries within internal development pipelines. When the Endpoint Detection and Response (EDR) agent scans a developer’s workstation containing local copies of these artifacts, it may flag the file hash or network signature as an active threat rather than a static asset.
  • Filter/Exclusion: Exclude specific file paths associated with the R&D department (e.g., C:\Dev\Staging\CobaltStrike*) and whitelist the specific SHA-256 hashes of known internal CS builds in the EDR console to prevent alerting on static file presence.

• Scheduled Maintenance Jobs by IT Operations

  • Scenario: The Infrastructure team runs a scheduled PowerShell job (Task Scheduler) every Sunday at 02:00 UTC that deploys updated configuration scripts using a Cobalt Strike Beacon wrapper to patch legacy servers. This legitimate automation triggers the rule’s network connection and process execution IOCs during maintenance windows.
  • Filter/Exclusion: Create an exclusion based on the parent process name powershell.exe running under the system account (NT AUTHORITY\SYSTEM) specifically for the scheduled task ID associated with the “Weekly Patch Deployment” job, or restrict alerting to business hours only if the maintenance window is strictly after-hours.

• Red Team Exercise and Penetration Testing

  • Scenario: During quarterly Red Team engagements, internal security analysts intentionally deploy Cobalt Strike Beacons across various network segments to simulate adversary movement. These controlled deployments generate high volumes of IOCs that mimic real attacks but are part of authorized testing activities.
  • Filter/Exclusion: