ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of Cobalt Strike beacons to establish persistent command and control channels within the network. Proactive hunting in Azure Sentinel is critical because early detection of these specific IOCs enables the SOC team to identify lateral movement and data exfiltration attempts before they escalate into a full-scale breach.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["208.87.207.196", "139.226.191.215"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["208.87.207.196", "139.226.191.215"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Cobalt Strike

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• IT Asset Management Scans via Lansweeper or SCCM

  • Scenario: During scheduled inventory sweeps, tools like Lansweeper or Microsoft Endpoint Configuration Manager (MECM/SCCM) execute the beacon.exe binary to gather hardware and software details from endpoints. These scans often utilize standard Cobalt Strike beacon configurations that match known IOCs for network connections and process execution.
  • Filter/Exclusion: Create an exclusion rule based on the Parent Process Name (e.g., LansweeperAgent.exe or ccmexec.exe) launching beacon.exe. Additionally, exclude traffic originating from specific Asset Management Subnets where these agents are deployed.

• Automated Patch Deployment via Chocolatey or PDQ Deploy

  • Scenario: System administrators use automation tools like Chocolatey or PDQ Deploy to push security updates and software installations. These tools frequently invoke Cobalt Strike beacons as part of their deployment verification scripts to confirm successful installation and configuration on target workstations before closing the ticket.
  • Filter/Exclusion: Filter alerts where the Command Line Arguments contain specific flags associated with the deployment tool (e.g., -choco, --pdq-deploy) or exclude events triggered by service accounts named svc-chocolatey or svc-pdqdeploy.

• Scheduled Security Audits using PowerShell Scripts

  • Scenario: A recurring Task Scheduler job runs a custom PowerShell script (SecurityAudit.ps1) that invokes the Cobalt Strike beacon to perform vulnerability checks and compliance reporting against internal servers. This is often triggered nightly by the SYSTEM account or a