ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of Cobalt Strike Command and Control infrastructure, specifically looking for network connections to known malicious IPs and file hashes used in active post-exploitation campaigns. Proactively hunting these indicators within Azure Sentinel is critical because Cobalt Strike’s modular beacon architecture often evades standard signature-based defenses, requiring early detection to prevent lateral movement and data exfiltration before the adversary establishes a persistent foothold.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["203.91.75.89", "107.173.85.194", "203.9.150.13"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["203.91.75.89", "107.173.85.194", "203.9.150.13"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Cobalt Strike

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule in an enterprise environment, including suggested filters or exclusions:

• Software Deployment via SCCM/MECM

  • Scenario: The IT Operations team deploys a new version of a standard utility (e.g., Wireshark or Adobe Reader) using Microsoft Endpoint Configuration Manager (SCCM). The deployment package includes the beacon.exe binary (a common Cobalt Strike component name) which is executed by the ccmexec.exe service account. This triggers the rule because the hash matches a known Cobalt Strike IOC, but the context is a scheduled software rollout rather than an attacker’s command-and-control (C2) beacon.
  • Suggested Filter: Exclude events where the parent process is ccmexec.exe or TaskScheduler.exe and the user account belongs to the “IT_Operations” security group, specifically during standard business hours (08:00–17:00).

• Automated Patching with WSUS

  • Scenario: A scheduled Windows Update task runs on a domain controller to apply critical security patches. The update installer (wuauclt.exe or msiexec.exe) extracts and executes temporary files in the %TEMP% directory. One of these extracted components matches a Cobalt Strike IOC hash (often due to shared libraries or common open-source dependencies used by both Microsoft and Cobalt Strike).
  • Suggested Filter: Create an exclusion for processes originating from C:\Windows\SoftwareDistribution\Download or %TEMP% directories where the parent process is wuauclt.exe, provided the execution occurs within a 2-hour window of the scheduled “Patch Tuesday” maintenance job.

• Endpoint Detection and Response (EDR) Scans *