ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of Cobalt Strike beacons and their associated infrastructure to establish persistent command-and-control channels within the network. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early detection of this widely used post-exploitation tool allows the SOC team to identify active intrusions before adversaries can execute lateral movement or data exfiltration.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 8 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`165[.]154[.]240[.]17:80`	botnet_cc	2026-07-14	100%
ip:port	`165[.]154[.]240[.]17:443`	botnet_cc	2026-07-14	100%
ip:port	`64[.]90[.]13[.]61:443`	botnet_cc	2026-07-14	100%
ip:port	`64[.]90[.]13[.]61:8080`	botnet_cc	2026-07-14	100%
ip:port	`151[.]239[.]24[.]33:80`	botnet_cc	2026-07-14	100%
ip:port	`151[.]239[.]24[.]33:8080`	botnet_cc	2026-07-14	100%
ip:port	`151[.]239[.]24[.]33:443`	botnet_cc	2026-07-14	100%
ip:port	`39[.]105[.]94[.]168:80`	botnet_cc	2026-07-14	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["151.239.24.33", "64.90.13.61", "39.105.94.168", "165.154.240.17"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["151.239.24.33", "64.90.13.61", "39.105.94.168", "165.154.240.17"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule, tailored for an enterprise environment:

Enterprise Endpoint Management Deployments
- Scenario: The IT Operations team uses Microsoft SCCM (Configuration Manager) or Ivanti to push a scheduled software update or patch deployment. These tools often utilize the same underlying HTTP/HTTPS communication patterns and specific User-Agent strings that Cobalt Strike’s Beacon mimics when establishing C2 channels.
- Filter/Exclusion: Create an exclusion for traffic originating from known SCCM/Ivanti management server IP ranges (e.g., 10.50.20.0/24) and whitelist the specific User-Agent strings associated with these deployment agents (e.g., Microsoft-SoftwareUpdateAgent).
Automated Backup and Snapshot Jobs
- Scenario: A nightly scheduled job running Veeam Backup & Replication or Commvault initiates a backup task. These applications frequently open outbound connections to cloud storage gateways (like AWS S3 or Azure Blob) using standard ports (80/443) and may generate hash signatures that overlap with Cobalt Strike’s beacon configuration files.
- Filter/Exclusion: Filter out alerts where the source process name matches VeeamAgent.exe or cvp.exe, specifically when the destination IP belongs to the organization’s designated backup cloud provider CIDR blocks.
Third-Party Security Scanning Agents
- Scenario: The organization runs a vulnerability scanner like Tenable Nessus, Qualys, or Rapid7 InsightVM. During a scheduled scan, these agents probe internal hosts and establish persistent connections to their central management console, often utilizing the same beacon intervals and HTTP headers that trigger Cobalt Strike IOCs.