ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of Cobalt Strike beacons by identifying four specific indicators of compromise known to facilitate command and control communications within Azure Sentinel environments. The SOC team should proactively search for these signatures because early identification of this widely used post-exploitation tool allows for rapid containment before attackers establish persistent footholds or execute lateral movement across the network.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`159[.]75[.]195[.]231:443`	botnet_cc	2026-07-04	100%
ip:port	`47[.]116[.]57[.]211:8888`	botnet_cc	2026-07-04	100%
ip:port	`176[.]121[.]49[.]1:8086`	botnet_cc	2026-07-04	100%
ip:port	`119[.]29[.]91[.]172:5555`	botnet_cc	2026-07-04	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["159.75.195.231", "119.29.91.172", "47.116.57.211", "176.121.49.1"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["159.75.195.231", "119.29.91.172", "47.116.57.211", "176.121.49.1"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule, along with recommended filters or exclusions:

Enterprise Endpoint Protection Scans
- Scenario: The organization’s EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled deep scan of the C:\Program Files\CS directory. During this process, the scanner extracts embedded resources from legitimate Cobalt Strike binaries used by internal IT teams, triggering network connections to known ThreatFox IOCs that match standard Cobalt Strike beacon behavior (e.g., specific User-Agent strings or certificate thumbprints).
- Suggested Filter: Exclude processes where the parent executable is the EDR agent itself (e.g., C:\Program Files\CrowdStrike\fs.exe or MsMpEng.exe) and the destination IP belongs to the internal management subnet.
Automated Patch Management Deployments
- Scenario: The IT Operations team uses a configuration management tool like Ansible or SCCM (System Center Configuration Manager) to deploy security patches. These tools often utilize Cobalt Strike as a lightweight remote execution agent during the deployment window, causing scheduled jobs to initiate outbound connections to the Cobalt Strike command and control (C2) servers defined in the ThreatFox IOC list.
- Suggested Filter: Create an exclusion for traffic originating from specific service accounts (e.g., svc-patch-deploy) running on jump hosts or management servers, specifically during the maintenance window hours (e.g., Sunday 02:00–06:00 UTC).
Software Development and QA Testing
- Scenario: The internal DevOps team utilizes Cobalt Strike within their CI/CD pipeline (hosted on Jenkins or GitLab Runners) to perform automated security testing and vulnerability