ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of Cobalt Strike beacons to establish persistent command-and-control channels and execute lateral movement within the network. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early detection of this widely used post-exploitation tool allows the SOC team to disrupt active intrusions before adversaries can fully map the environment or exfiltrate sensitive data.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 2 IOC Types: ip:port, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["188.119.64.104"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["188.119.64.104"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Cobalt Strike
let malicious_urls = dynamic(["http://192.168.88.143:80/9x5w"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Cobalt Strike

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule, along with recommended filters and exclusions tailored for an enterprise environment:

• Red Team and Purple Team Exercises

  • Scenario: Internal security teams frequently deploy Cobalt Strike during scheduled Red Team engagements or Purple Team workshops to simulate adversary behavior. These exercises intentionally generate the exact IOCs (e.g., specific beacon artifacts, C2 traffic patterns) that this rule is designed to catch, leading to high-volume alerts during known test windows.
  • Filter/Exclusion: Create a time-based suppression policy for alerts originating from the “Security-RedTeam” Organizational Unit (OU) or IP subnets dedicated to testing infrastructure. Additionally, tag these events with a ThreatType: Exercise label in the SIEM to route them to a separate dashboard rather than the main incident queue.

• Software Deployment via SCCM/Intune

  • Scenario: The IT Operations team utilizes Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune to push software updates and configuration scripts across the enterprise. During these mass deployments, legitimate administrative agents may execute scripts that mimic Cobalt Strike’s file creation patterns or network handshake signatures, particularly when deploying custom management tools that share similar hashing characteristics with known IOCs.
  • Filter/Exclusion: Exclude alerts where the process parent is ccmexec.exe (SCCM) or IntuneManagementExtension.exe. Implement a whitelist for specific file hashes associated with the organization’s standard deployment toolkit if they overlap with the Cobalt Strike IOC list.

• Scheduled Compliance Auditing Jobs

  • Scenario: Automated compliance scanning tools, such as Qualys or Tenable Nessus, run scheduled agents on endpoints to assess vulnerability posture. These scanners often generate temporary files and initiate network connections that match the IOCs associated with Cobalt