ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hypothesis targets the presence of known Cobalt Strike indicators, which adversaries frequently use to establish command-and-control channels and execute post-exploitation actions. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised assets early, potentially disrupting the attacker’s operational timeline before they achieve deeper lateral movement or data exfiltration.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 7 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`43[.]166[.]202[.]32:8080`	botnet_cc	2026-09-14	100%
ip:port	`43[.]166[.]202[.]32:8317`	botnet_cc	2026-09-14	100%
ip:port	`45[.]86[.]64[.]228:8080`	botnet_cc	2026-09-14	100%
ip:port	`43[.]166[.]202[.]32:443`	botnet_cc	2026-09-14	100%
ip:port	`43[.]166[.]202[.]32:22`	botnet_cc	2026-09-14	100%
ip:port	`217[.]154[.]212[.]25:3389`	botnet_cc	2026-09-14	100%
ip:port	`217[.]154[.]212[.]25:22`	botnet_cc	2026-09-14	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["217.154.212.25", "45.86.64.228", "43.166.202.32"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["217.154.212.25", "45.86.64.228", "43.166.202.32"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Legitimate Internal Penetration Testing or Red Team Exercises
- Scenario: Security teams or external vendors conduct authorized penetration tests using Cobalt Strike to validate detection coverage. During these engagements, the tool generates known IOCs (e.g., specific beacon hashes, DNS patterns, or file paths) that are expected but not malicious in the context of the engagement.
- Filter/Exclusion: Create a dynamic exclusion list based on the specific IP ranges or hostnames associated with the authorized testing team. Alternatively, tag the relevant user accounts or service accounts with a PenTest tag and exclude events where UserTags contains PenTest during the defined engagement window.
Development and QA Environments Running Cobalt Strike for Tooling Development
- Scenario: Software development teams building security tools, SIEM integrations, or endpoint detection agents may run Cobalt Strike in isolated development or QA environments to test interoperability. These environments often host the same IOCs (e.g., beacon.exe in a non-standard path, specific registry keys) as production attacks.
- Filter/Exclusion: Exclude events where the SourceComputer matches known development or QA server naming conventions (e.g., dev-*, qa-*, build-*). Additionally, exclude if the User belongs to a specific security engineering group (e.g., SecurityDevOps) and the ProcessPath resides in a designated development directory (e.g., C:\Projects\CobaltStrike\).
Scheduled Maintenance Jobs or Backup Agents Using Cobalt Strike Components
- Scenario: Some enterprise backup or configuration management solutions may bundle or reference Cobalt Strike components for specific agent-to-agent communication or configuration sync tasks. Scheduled jobs running under a service account might trigger IOCs related to file creation or network connections associated with the Cobalt Strike beacon.