ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of Cobalt Strike beacon tools, specifically identifying six key indicators of compromise that signal active command and control infrastructure within the network. Proactively hunting for these IOCs in Azure Sentinel is critical to rapidly detect and contain sophisticated post-exploitation activities before adversaries establish persistent footholds or exfiltrate sensitive data.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 6 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`178[.]62[.]3[.]223:8443`	botnet_cc	2026-06-29	90%
ip:port	`151[.]239[.]25[.]40:443`	botnet_cc	2026-06-29	100%
ip:port	`38[.]38[.]250[.]68:443`	botnet_cc	2026-06-29	100%
ip:port	`27[.]133[.]154[.]218:8443`	botnet_cc	2026-06-29	100%
ip:port	`38[.]190[.]224[.]61:8082`	botnet_cc	2026-06-29	100%
ip:port	`151[.]239[.]25[.]40:9090`	botnet_cc	2026-06-29	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["27.133.154.218", "38.38.250.68", "151.239.25.40", "38.190.224.61", "178.62.3.223"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["27.133.154.218", "38.38.250.68", "151.239.25.40", "38.190.224.61", "178.62.3.223"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Red Teaming and Purple Team Exercises
- Scenario: Internal security teams intentionally deploy Cobalt Strike (CS) beacons during scheduled red team engagements to test the organization’s detection capabilities. These legitimate simulations generate network traffic and file hashes that match the 6 IOCs exactly, triggering alerts despite being authorized activity.
- Filter/Exclusion: Create a time-based exclusion for known exercise windows or tag specific “Red Team” source IP ranges (e.g., 10.50.x.x) as trusted. Additionally, correlate with ticketing system data to suppress alerts if an active “Exercise” ticket exists in Jira or ServiceNow during the event window.
Endpoint Detection and Response (EDR) Management Agents
- Scenario: Enterprise EDR solutions like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne often utilize Cobalt Strike-based agents or management consoles to push policy updates, collect telemetry, or manage remote sessions. The communication between the central console and managed endpoints may mimic the network signatures of a CS beacon.
- Filter/Exclusion: Exclude traffic originating from known EDR management server IPs (e.g., 192.168.10.5 for CrowdStrike) or filter out processes running under specific service accounts (e.g., NT SERVICE\DefenderSvc). Verify the process parent is the EDR agent executable rather than a generic user shell (cmd.exe, powershell.exe).
Automated Patch Management and Configuration Scripts
- Scenario: IT Operations teams use scheduled PowerShell scripts or tools like Ansible, SCCM (System Center Configuration Manager), or **