ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This detection rule identifies adversary behavior where attackers deploy Cobalt Strike beacons to establish initial access and maintain persistence within the network following successful phishing campaigns or credential compromise. A SOC team should proactively hunt for these indicators in Azure Sentinel because Cobalt Strike’s sophisticated capabilities for lateral movement make it a critical early-stage signal of advanced threats that could lead to significant data exfiltration if left undetected.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 8 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`137[.]220[.]151[.]95:445`	botnet_cc	2026-08-27	100%
ip:port	`43[.]143[.]13[.]146:123`	botnet_cc	2026-08-27	100%
ip:port	`182[.]92[.]78[.]7:22`	botnet_cc	2026-08-27	100%
ip:port	`193[.]160[.]32[.]138:8085`	botnet_cc	2026-08-27	100%
ip:port	`47[.]109[.]23[.]77:22`	botnet_cc	2026-08-27	100%
ip:port	`47[.]109[.]23[.]77:8888`	botnet_cc	2026-08-27	100%
ip:port	`137[.]220[.]151[.]95:8888`	botnet_cc	2026-08-27	100%
ip:port	`154[.]12[.]90[.]231:443`	botnet_cc	2026-08-27	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["47.109.23.77", "182.92.78.7", "43.143.13.146", "193.160.32.138", "137.220.151.95", "154.12.90.231"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["47.109.23.77", "182.92.78.7", "43.143.13.146", "193.160.32.138", "137.220.151.95", "154.12.90.231"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs rule, including context and recommended filters/exclusions:

Legitimate Security Assessment & Red Teaming
- Scenario: Internal security teams or external auditors (e.g., using tools like Burp Suite, Nmap, or custom Python scripts) frequently deploy Cobalt Strike Beacon clients to simulate attack chains, test lateral movement controls, and validate detection logic. These legitimate “Red Team” exercises often generate the exact same IOCs (specific process names, network signatures, and registry keys) that the rule flags as malicious.
- Filter/Exclusion: Create an exclusion for processes running under specific service accounts dedicated to security testing (e.g., DOMAIN\SecOps_RedTeam) or exclude traffic originating from a designated “Red Team” IP subnet (e.g., 10.50.20.0/24).
Scheduled Patch Management & Configuration Drift Checks
- Scenario: Enterprise IT operations utilize automated deployment tools like Microsoft Endpoint Configuration Manager (MECM) or Ansible Tower to push updates and configuration changes. These tools often spawn background processes that mimic Cobalt Strike’s network behavior (e.g., establishing persistent HTTPS connections to a central management server) or utilize similar command-line arguments during scheduled maintenance windows.
- Filter/Exclusion: Implement a time-based exclusion for the rule during known maintenance windows (e.g., 02:00–04:00 UTC on Sundays) and exclude processes where the parent process is ccmexec.exe or ansible-runner.
DevOps CI/CD Pipeline Execution
- Scenario: In environments with active Software Development Life Cycle (SDLC), build agents (such as Azure DevOps Agents, Jenkins, or **