ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt targets adversaries leveraging weaponized Cobalt Strike tools to establish persistent backdoors, execute arbitrary code, and exfiltrate sensitive data through command-and-control channels. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early detection of this high-severity activity allows the SOC team to disrupt advanced post-exploitation phases before significant data loss occurs.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["106.54.44.181", "116.11.4.167", "118.89.69.45"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["106.54.44.181", "116.11.4.167", "118.89.69.45"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Cobalt Strike

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs rule in an enterprise environment, along with suggested filters or exclusions:

• Internal Penetration Testing Campaigns

  • Scenario: The internal Red Team executes a scheduled quarterly vulnerability assessment using Cobalt Strike. They deploy the beacon.exe agent to multiple workstations and servers within the “Dev-Test” VLAN to simulate lateral movement, triggering C2 traffic on standard ports (80/443) that matches known IOCs.
  • Filter/Exclusion: Create a whitelist rule excluding traffic originating from the Red Team’s jump host IP range (10.x.x.50/29) and destination assets tagged with Environment=Test or ProjectID=Q3-Pentest. Additionally, exclude specific SHA-256 hashes of the known internal Cobalt Strike binaries used by the security team.

• IT Helpdesk Remote Support Sessions

  • Scenario: The Service Desk utilizes a custom wrapper script that launches a lightweight Cobalt Strike beacon to provide deep remote diagnostics for high-priority tickets (e.g., complex Active Directory issues). This tool is installed on the “HelpDesk-Admin” OU computers and connects to an internal management server during business hours.
  • Filter/Exclusion: Exclude alerts where the source host belongs to the OU=Service Desk or OU=IT Admins Organizational Units. Furthermore, filter for processes launched by the specific service account svc-helpdesk-support rather than generic system accounts like SYSTEM.

• Automated Patch Management and Configuration Baseline Jobs

  • Scenario: The enterprise uses a scheduled PowerShell job (Task Scheduler) to run configuration compliance checks across critical servers. This job invokes a Cobalt Strike beacon module to gather real-time telemetry on service states and