ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt targets adversary behavior indicative of Cobalt Strike beacon deployment by actively searching for ten specific indicators of compromise across network and endpoint logs. Proactively hunting for these signatures in Azure Sentinel is critical to rapidly identify early-stage lateral movement or command-and-control communications before the threat actor establishes a persistent foothold within the environment.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 10 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`152[.]32[.]132[.]177:8899`	botnet_cc	2026-06-30	100%
ip:port	`39[.]97[.]246[.]75:80`	botnet_cc	2026-06-30	100%
ip:port	`179[.]43[.]190[.]13:8080`	botnet_cc	2026-06-30	100%
ip:port	`134[.]122[.]187[.]85:443`	botnet_cc	2026-06-30	100%
ip:port	`134[.]122[.]187[.]85:9999`	botnet_cc	2026-06-30	100%
ip:port	`1[.]14[.]227[.]23:443`	botnet_cc	2026-06-30	100%
ip:port	`162[.]243[.]103[.]246:8443`	botnet_cc	2026-06-30	90%
ip:port	`150[.]109[.]186[.]36:64401`	botnet_cc	2026-06-29	75%
ip:port	`172[.]245[.]226[.]124:443`	botnet_cc	2026-06-29	100%
ip:port	`172[.]245[.]226[.]124:80`	botnet_cc	2026-06-29	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["150.109.186.36", "134.122.187.85", "172.245.226.124", "152.32.132.177", "39.97.246.75", "179.43.190.13", "1.14.227.23", "162.243.103.246"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["150.109.186.36", "134.122.187.85", "172.245.226.124", "152.32.132.177", "39.97.246.75", "179.43.190.13", "1.14.227.23", "162.243.103.246"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Here are four specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

IT Asset Management Scans via Lansweeper or SCCM
- Scenario: During scheduled inventory sweeps, tools like Lansweeper, Microsoft Endpoint Configuration Manager (SCCM), or SolarWinds NPM execute background agents that generate network traffic patterns and process behaviors mimicking Cobalt Strike’s beaconing. These agents often open ephemeral outbound connections to central management servers using similar port ranges and TLS handshakes, triggering the “Cobalt Strike Beacon” IOC.
- Suggested Filter: Exclude traffic originating from known asset management server subnets (e.g., 10.20.50.0/24) or filter out processes with specific binary hashes associated with the SCCM agent (ccmexec.exe) and Lansweeper scanner service running under the SYSTEM or NT AUTHORITY\NETWORK SERVICE context.
Automated Patch Deployment via Windows Update for Business
- Scenario: Enterprise-wide patching cycles orchestrated by WSUS (Windows Server Update Services) or third-party tools like Ivanti Patch involve background services (UsoSvc, Wuauserv) establishing persistent connections to update repositories. The rule may flag the specific User-Agent strings, certificate thumbprints, or the creation of temporary network shares used during the deployment phase as Cobalt Strike IOCs.
- Suggested Filter: Create an exclusion for scheduled tasks named “Windows Update” or “Patch Deployment” running between 01:00 and 05:00 UTC on weekdays. Additionally, whitelist the specific destination IP ranges of the organization’s internal WSUS servers and Microsoft Update CDN endpoints known to be used by the patching infrastructure.