ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of Cobalt Strike beacon tools by matching network and host telemetry against a curated set of eleven specific indicators of compromise. A SOC team should proactively hunt for these signatures in Azure Sentinel to rapidly identify and contain active post-exploitation tooling that often serves as a critical foothold for lateral movement and command-and-control operations within the enterprise environment.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 11 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`106[.]55[.]25[.]253:80`	botnet_cc	2026-08-31	100%
ip:port	`106[.]55[.]25[.]253:8080`	botnet_cc	2026-08-31	100%
ip:port	`106[.]55[.]25[.]253:443`	botnet_cc	2026-08-31	100%
ip:port	`8[.]148[.]26[.]139:22`	botnet_cc	2026-08-31	100%
ip:port	`196[.]251[.]121[.]183:4433`	botnet_cc	2026-08-31	50%
ip:port	`216[.]203[.]20[.]232:443`	botnet_cc	2026-08-31	50%
ip:port	`8[.]148[.]26[.]139:80`	botnet_cc	2026-08-31	100%
ip:port	`8[.]148[.]26[.]139:8080`	botnet_cc	2026-08-31	100%
ip:port	`8[.]148[.]26[.]139:9999`	botnet_cc	2026-08-31	100%
ip:port	`8[.]148[.]26[.]139:443`	botnet_cc	2026-08-31	100%
ip:port	`106[.]15[.]10[.]2:5672`	botnet_cc	2026-08-31	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["106.15.10.2", "216.203.20.232", "196.251.121.183", "106.55.25.253", "8.148.26.139"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["106.15.10.2", "216.203.20.232", "196.251.121.183", "106.55.25.253", "8.148.26.139"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: Cobalt Strike IOCs detection rule in an enterprise environment:

Scenario: Legitimate DevOps Pipeline Execution
- Context: The organization’s CI/CD pipeline (e.g., Jenkins or GitLab Runner) utilizes a custom build agent that executes a Python-based script to deploy artifacts. This script mimics the beacon.exe process structure and network behavior of Cobalt Strike by establishing outbound HTTPS connections to internal artifact repositories on port 443, triggering the “Cobalt Strike Beacon” IOC.
- Suggested Filter/Exclusion: Exclude processes where the executable path matches the DevOps agent directory (e.g., D:\Jenkins\workspace\build-agent.exe) and the parent process is the CI server service (java.exe or dockerd). Additionally, filter out traffic destined for known internal artifact repository IP ranges.
Scenario: Scheduled Third-Party Backup Agent
- Context: The enterprise utilizes Veeam Backup & Replication agents installed on critical file servers. During the nightly backup window (02:00 – 04:00), the VeeamAgent.exe process initiates a communication channel with the management server that shares specific registry keys and network signatures identical to Cobalt Strike’s C2 infrastructure, causing a hit on the “Cobalt Strike Team Server” IOC.
- Suggested Filter/Exclusion: Create an exclusion based on the executable name VeeamAgent.exe running under the SYSTEM or specific service account (e.g., DOMAIN\BackupSvc). Furthermore, apply a time-based filter to suppress alerts for this rule between 02:00 and 04:00 daily when backup jobs are active.
Scenario: Internal Security Assessment Tool