ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of Cobalt Strike beacons by identifying three specific Indicators of Compromise (IOCs) known to facilitate command and control communications. A SOC team should proactively search for these signatures in Azure Sentinel because early identification of this widely used post-exploitation tool allows for rapid containment before attackers establish persistent footholds within the network.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["103.43.18.230", "8.141.121.30", "198.46.175.153"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["103.43.18.230", "8.141.121.30", "198.46.175.153"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Cobalt Strike

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Management Agent Updates

  • Scenario: The deployment of a new Endpoint Detection and Response (EDR) agent version by tools like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint. These agents often utilize Cobalt Strike’s underlying communication libraries or generate network traffic patterns that mimic the specific IOCs (e.g., specific User-Agent strings or beacon intervals) defined in the hunt package during their scheduled update cycles.
  • Filter/Exclusion: Exclude processes originating from known EDR service accounts (e.g., svc-crowdstrike, SentinelOne-Service) and restrict alerts to non-standard ports if the EDR traffic is expected on standard HTTPS (443) or a dedicated management port.

• IT Asset Inventory Scans via Lansweeper or SCCM

  • Scenario: Scheduled inventory scans performed by Lansweeper, Microsoft Endpoint Configuration Manager (SCCM), or SolarWinds NPM. These tools frequently deploy lightweight agents that perform active network discovery and asset verification, which can trigger the “Cobalt Strike Beacon” IOC due to similar heartbeat mechanisms and DNS query patterns used for asset tracking.
  • Filter/Exclusion: Create a whitelist based on the specific IP ranges of internal management servers (e.g., 10.x.x.x range) and exclude hostnames containing keywords like _SCCM, _Lansweeper, or _InventoryAgent.

• Automated Patch Management Execution

  • Scenario: The execution of automated patching jobs using tools like Ivanti Control, ManageEngine Patch Manager, or custom PowerShell scripts running under the SYSTEM or