ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt targets the presence of known Cobalt Strike indicators of compromise, which adversaries frequently deploy to establish command-and-control channels and execute post-exploitation actions. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify active intrusions early, potentially before the attacker achieves lateral movement or data exfiltration.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 7 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`193[.]239[.]86[.]192:22`	botnet_cc	2026-09-06	100%
ip:port	`193[.]239[.]86[.]192:7000`	botnet_cc	2026-09-06	100%
ip:port	`193[.]239[.]86[.]192:8080`	botnet_cc	2026-09-06	100%
ip:port	`193[.]239[.]86[.]192:7443`	botnet_cc	2026-09-06	100%
ip:port	`193[.]239[.]86[.]192:443`	botnet_cc	2026-09-06	100%
ip:port	`193[.]239[.]86[.]192:80`	botnet_cc	2026-09-06	100%
ip:port	`152[.]136[.]253[.]101:53`	botnet_cc	2026-09-06	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["193.239.86.192", "152.136.253.101"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["193.239.86.192", "152.136.253.101"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Legitimate Red Team or Purple Team Exercises: Internal security teams often deploy Cobalt Strike to simulate attacks and validate detection capabilities. To prevent alert fatigue, create a dynamic security group or tag (e.g., Tag: RedTeam) for hosts and service accounts involved in these exercises, and exclude events where the source or destination matches this tag during the scheduled exercise window.
Development and QA Environments: Developers and QA engineers may use Cobalt Strike’s Beacon or related tools in isolated staging environments to test application resilience or debug network communication issues. Exclude hosts within specific subnets (e.g., 10.20.0.0/24) or virtual machine names containing dev- or qa- prefixes from the hunt package, provided these environments are logically separated from production networks.
Third-Party Managed Detection and Response (MDR) Agents: Some MDR providers or specialized EDR vendors may use Cobalt Strike-like frameworks or share IOCs with their own agent infrastructure for advanced threat hunting. If your organization uses an MDR provider that utilizes these specific IOCs, whitelist the specific process names (e.g., beacon.exe variants) or the unique hash values associated with the MDR agent, ensuring the exclusion is scoped to the specific MDR service account or host group.
Legacy Application Updates or Patching Tools: Certain enterprise patch management or configuration management tools (e.g., custom scripts wrapping wsman or winrs that mimic Cobalt Strike’s beacon behavior for remote execution) might trigger false positives if they use similar binary names or memory patterns. Identify the specific executable path (e.g., C:\Program Files\InternalTools\Updater\beacon.exe) and add a path-based exclusion filter for that specific directory, verifying that the binary is signed by the internal CA.
Scheduled Maintenance Jobs Using Custom Scripts: IT operations