ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving known Cobalt Strike indicators of compromise (IOCs), which are frequently utilized by threat actors to establish command and control channels during post-exploitation phases. Proactively hunting for these IOCs within Azure Sentinel is critical because Cobalt Strike remains a ubiquitous tool for lateral movement and data exfiltration, allowing the SOC team to rapidly detect and contain active intrusions before they escalate into significant breaches.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 14 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`43[.]128[.]21[.]190:123`	botnet_cc	2026-08-14	100%
ip:port	`108[.]165[.]147[.]244:18080`	botnet_cc	2026-08-14	100%
ip:port	`47[.]79[.]98[.]75:8080`	botnet_cc	2026-08-14	100%
ip:port	`68[.]64[.]182[.]169:8001`	botnet_cc	2026-08-14	100%
ip:port	`212[.]87[.]199[.]197:80`	botnet_cc	2026-08-14	100%
ip:port	`47[.]79[.]98[.]75:80`	botnet_cc	2026-08-14	100%
ip:port	`212[.]87[.]199[.]197:443`	botnet_cc	2026-08-14	100%
ip:port	`101[.]43[.]39[.]2:88`	botnet_cc	2026-08-14	100%
ip:port	`1[.]94[.]145[.]106:8888`	botnet_cc	2026-08-14	100%
ip:port	`47[.]79[.]98[.]75:443`	botnet_cc	2026-08-14	100%
ip:port	`212[.]87[.]199[.]197:8080`	botnet_cc	2026-08-14	100%
ip:port	`47[.]79[.]98[.]75:22`	botnet_cc	2026-08-14	100%
ip:port	`98[.]80[.]179[.]181:443`	botnet_cc	2026-08-14	50%
ip:port	`213[.]111[.]157[.]231:22222`	botnet_cc	2026-08-14	50%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["68.64.182.169", "47.79.98.75", "101.43.39.2", "1.94.145.106", "212.87.199.197", "213.111.157.231", "43.128.21.190", "98.80.179.181", "108.165.147.244"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["68.64.182.169", "47.79.98.75", "101.43.39.2", "1.94.145.106", "212.87.199.197", "213.111.157.231", "43.128.21.190", "98.80.179.181", "108.165.147.244"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Automated Patch Deployment via SCCM/Intune
- Context: System Center Configuration Manager (SCCM) or Microsoft Intune agents frequently deploy software updates that utilize the same underlying C2 beacon architecture or specific DLLs identified in the Cobalt Strike IOC list. The deployment process often spawns ccmexec.exe or msiexec.exe processes that match the hash signatures of known Cobalt Strike components used by legitimate patching tools.
- Suggested Filter/Exclusion: Create an exclusion rule based on Process Name (ccmexec.exe, Microsoft.IntuneManagementAgent.exe) and Parent Process (e.g., TaskHostW.exe or svchost.exe). Additionally, exclude alerts where the process path resides within the standard enterprise management directories (e.g., C:\Program Files\Microsoft Configuration Manager\ or C:\Windows\System32\GroupPolicy\Machine\).
Scenario: Scheduled Backup Jobs Using Veeam or Commvault
- Context: Enterprise backup solutions like Veeam Backup & Replication often utilize a “beacon” style agent to communicate with the central console. The detection logic may flag the communication patterns (specific ports and certificate thumbprints) of these agents as matching Cobalt Strike’s C2 traffic, especially during nightly scheduled jobs where high-volume data exfiltration occurs.
- Suggested Filter/Exclusion: Implement a filter based on Scheduled Task Name or Service Name. Exclude alerts originating from services named VeeamBackupSvc, CommServeAgent, or processes running under the context of specific backup accounts (e.g., DOMAIN\VeeamBackupAccount). If