ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of Cobalt Strike beacons, which are frequently used by threat actors to establish persistent command and control channels within compromised networks. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early detection of this tool allows the SOC team to identify active lateral movement and data exfiltration attempts before they escalate into a full-scale breach.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 6 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["106.13.74.185", "81.70.21.248", "137.220.194.15", "139.59.255.98"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["106.13.74.185", "81.70.21.248", "137.220.194.15", "139.59.255.98"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Cobalt Strike
let malicious_domains = dynamic(["r0.erloro.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Cobalt Strike

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule, tailored for a legitimate enterprise environment:

• IT Asset Management Scans via Lansweeper or ManageEngine

  • Scenario: The IT operations team runs scheduled inventory scans using tools like Lansweeper or ManageEngine Endpoint Central. These agents often utilize the same network beaconing mechanisms and specific DLL injection techniques that Cobalt Strike uses to maintain persistent connections with their management servers, triggering the “Cobalt Strike Beacon” IOC.
  • Filter/Exclusion: Exclude traffic originating from the specific IP ranges of the internal asset management servers or filter out processes running under the service accounts LansweeperAgent and MEEndpointService.

• Software Deployment via SCCM (Microsoft Endpoint Configuration Manager)

  • Scenario: During large-scale software deployments, SCCM agents utilize PowerShell scripts to download and execute installation packages. The detection logic may flag the specific network handshake patterns or the use of PowerShell.exe launching child processes with arguments resembling Cobalt Strike’s command-line execution (e.g., -c, -f) as a potential beacon activity.
  • Filter/Exclusion: Create an exclusion for process paths located in C:\Program Files\Microsoft Configuration Manager\ccmexec.exe and filter out network connections where the destination port matches the internal SCCM site server (typically TCP 8530 or 443) with a known internal IP.

• Scheduled Patch Management Jobs using WSUS or Ivanti

  • Scenario: Automated patch management cycles often trigger background jobs that check for updates and download payloads. Tools like WSUS or Ivanti Neurons may generate network traffic patterns involving periodic heartbeats and file transfers that mimic the Cobalt Strike “Callback” IOC, especially