ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of Cobalt Strike beacons by correlating network and process telemetry against a curated set of 15 known indicators of compromise. Proactively hunting for these signatures in Azure Sentinel is critical to rapidly identify active command-and-control communications or lateral movement attempts before they escalate into full-scale breaches.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 15 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`39[.]106[.]113[.]249:81`	botnet_cc	2026-07-09	100%
ip:port	`39[.]106[.]113[.]249:443`	botnet_cc	2026-07-09	100%
ip:port	`39[.]106[.]113[.]249:8080`	botnet_cc	2026-07-09	100%
ip:port	`152[.]32[.]202[.]240:80`	botnet_cc	2026-07-09	100%
ip:port	`152[.]32[.]202[.]240:8080`	botnet_cc	2026-07-09	100%
ip:port	`152[.]32[.]132[.]177:8080`	botnet_cc	2026-07-09	100%
ip:port	`152[.]32[.]132[.]177:80`	botnet_cc	2026-07-09	100%
ip:port	`151[.]239[.]25[.]40:80`	botnet_cc	2026-07-09	100%
ip:port	`151[.]239[.]25[.]40:8080`	botnet_cc	2026-07-09	100%
ip:port	`8[.]219[.]76[.]168:8080`	botnet_cc	2026-07-09	100%
ip:port	`139[.]199[.]89[.]128:80`	botnet_cc	2026-07-09	100%
ip:port	`39[.]105[.]201[.]165:8443`	botnet_cc	2026-07-09	100%
ip:port	`107[.]173[.]42[.]123:8080`	botnet_cc	2026-07-09	100%
ip:port	`107[.]173[.]42[.]123:80`	botnet_cc	2026-07-09	100%
ip:port	`47[.]121[.]137[.]8:8080`	botnet_cc	2026-07-09	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["8.219.76.168", "39.105.201.165", "107.173.42.123", "152.32.202.240", "151.239.25.40", "39.106.113.249", "139.199.89.128", "47.121.137.8", "152.32.132.177"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["8.219.76.168", "39.105.201.165", "107.173.42.123", "152.32.202.240", "151.239.25.40", "39.106.113.249", "139.199.89.128", "47.121.137.8", "152.32.132.177"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule in an enterprise environment, along with recommended filters and exclusions:

Internal Security Team Red Teaming Exercises
- Scenario: The internal Blue/Red team conducts scheduled penetration testing or attack simulation exercises using the official Cobalt Strike Beacon framework. These legitimate drills intentionally generate network traffic and file hashes matching the 15 IOCs to validate detection coverage.
- Filter/Exclusion: Create an exclusion rule based on the source IP range of the Security Operations Center (SOC) jump servers or specific “Red Team” Active Directory service accounts. Additionally, filter alerts where the process name is beacon.exe but the parent process is a known orchestration tool like Ansible or Jenkins.
Endpoint Detection and Response (EDR) Self-Updates
- Scenario: The enterprise EDR solution (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) utilizes Cobalt Strike-derived signatures or modules within its own update packages. When the EDR agent performs a scheduled daily definition update, it may drop files or execute scripts that match the rule’s IOCs.
- Filter/Exclusion: Exclude alerts originating from the specific hostnames of the EDR management servers or filter by process path containing the vendor’s installation directory (e.g., C:\Program Files\CrowdStrike\). Ensure the parent process is identified as the EDR service executable (e.g., CSFalconService.exe or MsMpEng.exe).
IT Operations Patch Management and Software Deployment
- Scenario: The IT Operations team uses deployment tools like Microsoft SCCM (Configuration Manager) or Ivanti Endpoint Manager to push software updates. These tools often utilize Cobalt Strike-based