ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This detection rule identifies adversary behavior characterized by Cobalt Strike’s command-and-control (C2) communications and lateral movement patterns following initial network infiltration via phishing or exploit kits. A proactive hunt is essential in Azure Sentinel to rapidly isolate compromised endpoints and prevent attackers from establishing persistent footholds that could facilitate broader data exfiltration or privilege escalation across the enterprise environment.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`115[.]159[.]226[.]190:80`	botnet_cc	2026-08-21	100%
ip:port	`186[.]241[.]75[.]21:80`	botnet_cc	2026-08-21	100%
ip:port	`123[.]57[.]42[.]41:8080`	botnet_cc	2026-08-21	100%
ip:port	`199[.]187[.]25[.]93:8443`	botnet_cc	2026-08-21	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["115.159.226.190", "186.241.75.21", "199.187.25.93", "123.57.42.41"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["115.159.226.190", "186.241.75.21", "199.187.25.93", "123.57.42.41"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs rule, including suggested filters and exclusions tailored for a legitimate enterprise environment:

Scenario: Automated Vulnerability Scanning via Internal Tools
- Context: Enterprise security teams often use internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) that utilize Cobalt Strike’s beacon architecture to perform active network discovery and asset inventory. These tools generate C2 traffic patterns identical to the malware, triggering the rule during scheduled scan windows.
- Suggested Filter/Exclusion: Create a whitelist for known scanner IP addresses or specific process names (e.g., nessus.exe, qualyspcagent.exe). Additionally, filter alerts where the destination port matches standard scanning ports (e.g., TCP 12489) and the traffic originates from the “Security Operations” VLAN.
Scenario: Scheduled Patch Management and Configuration Tasks
- Context: IT administrators frequently use Cobalt Strike beacons for remote patch deployment, configuration management, or software distribution via tools like Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ansible. These scheduled jobs often establish persistent C2 connections to the central management server, mimicking the “beacon” heartbeat of a compromised host.
- Suggested Filter/Exclusion: Exclude alerts generated during defined maintenance windows (e.g., Sunday 01:00–05:00 UTC). Implement a process exclusion for specific administrative executables such as ccmexec.exe or ansible-runner.exe when they initiate connections to known internal management subnets.
Scenario: Legitimate Remote Desktop and Support Sessions
- Context: Helpdesk teams utilize remote support tools (e.g., TeamViewer, **AnyDesk