ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt targets the presence of known Cobalt Strike indicators of compromise, which adversaries frequently deploy to establish command and control channels and execute post-exploitation actions within the network. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised assets early, potentially before the adversary leverages the framework for lateral movement or data exfiltration.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`83[.]229[.]123[.]249:22`	botnet_cc	2026-09-09	100%
ip:port	`83[.]229[.]123[.]249:8081`	botnet_cc	2026-09-09	100%
ip:port	`83[.]229[.]123[.]249:443`	botnet_cc	2026-09-09	100%
ip:port	`83[.]229[.]123[.]249:8080`	botnet_cc	2026-09-09	100%
ip:port	`83[.]229[.]123[.]249:80`	botnet_cc	2026-09-09	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["83.229.123.249"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["83.229.123.249"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Legitimate Internal Red Team or Penetration Testing
- Scenario: Internal security teams or contracted vendors conduct authorized penetration tests or red team exercises using Cobalt Strike to validate detection coverage and simulate advanced threats.
- Filter/Exclusion: Exclude events where the source user account belongs to a specific security group (e.g., Security-RedTeam) or where the source IP address falls within the designated internal testing subnet range (e.g., 10.20.0.0/24).
Development and QA Environment Testing
- Scenario: Developers or QA engineers use Cobalt Strike in isolated development or staging environments to test application resilience, API integrations, or security controls before production deployment.
- Filter/Exclusion: Exclude alerts originating from hosts tagged with environment labels such as env=dev, env=staging, or env=qa in your asset inventory or CMDB.
Scheduled Maintenance or Patching Scripts
- Scenario: Automated maintenance scripts or scheduled jobs (e.g., via Windows Task Scheduler or Cron) execute commands or network connections that match specific Cobalt Strike IOCs (such as beaconing intervals or specific hash values) during routine system updates or data synchronization tasks.
- Filter/Exclusion: Exclude events where the process name is a known maintenance tool (e.g., powershell.exe invoked by Task Scheduler with a specific task name like Monthly-Patch-Update) or where the parent process is a recognized service manager (e.g., svchost.exe for specific known services).
Third-Party Application Integration
- Scenario: Certain enterprise applications or middleware components (e.g., specific EDR agents, backup software, or monitoring tools) may use network protocols or command patterns that coincidentally match Cobalt Strike