ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This rule detects the presence of known Cobalt Strike indicators of compromise, which adversaries frequently deploy to establish command-and-control channels and execute post-exploitation activities. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify and isolate compromised assets before attackers can leverage the framework to escalate privileges or exfiltrate sensitive data.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 7 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`47[.]113[.]206[.]140:22`	botnet_cc	2026-09-04	100%
ip:port	`47[.]113[.]206[.]140:8888`	botnet_cc	2026-09-04	100%
ip:port	`154[.]94[.]224[.]35:8080`	botnet_cc	2026-09-04	100%
ip:port	`101[.]42[.]136[.]73:82`	botnet_cc	2026-09-04	100%
ip:port	`165[.]99[.]43[.]101:8080`	botnet_cc	2026-09-04	100%
ip:port	`165[.]99[.]43[.]101:80`	botnet_cc	2026-09-04	100%
ip:port	`165[.]99[.]43[.]101:443`	botnet_cc	2026-09-04	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["165.99.43.101", "154.94.224.35", "47.113.206.140", "101.42.136.73"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["165.99.43.101", "154.94.224.35", "47.113.206.140", "101.42.136.73"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Legitimate Internal Red Teaming or Penetration Testing
- Scenario: Internal security teams or contracted third-party pen testers use Cobalt Strike for authorized engagement phases, generating IOCs (such as specific beacon hashes, JA3 fingerprints, or known C2 domains) that match the threat feed.
- Filter/Exclusion: Exclude alerts where the source IP or hostname belongs to the designated RedTeam or PenTest security group, or correlate with an active ticket in the ITSM system tagged as “Authorized Engagement.”
Legacy or Staging Environment Artifacts
- Scenario: Staging or development environments retain old build artifacts, test scripts, or container images from previous security assessments that contain known Cobalt Strike beacon binaries or configuration files, triggering hash-based IOCs during routine file scans or integrity checks.
- Filter/Exclusion: Exclude alerts originating from file paths containing /staging/, /dev/, or /test/ directories, or exclude specific known legacy container images identified in the asset inventory.
Third-Party Application Update Packages
- Scenario: Certain enterprise applications (e.g., specific versions of remote access tools, virtual desktop infrastructure agents, or niche analytics software) bundle or reference Cobalt Strike-related components for interoperability or internal testing, causing their update packages to match known IOCs during deployment or file integrity monitoring.
- Filter/Exclusion: Create a whitelist for specific application names (e.g., CitrixReceiver.exe, VMwareTools.exe) or exclude alerts where the parent process is a known application installer (e.g., msiexec.exe with specific product codes).
Scheduled Security Scanning Jobs
- Scenario: Automated vulnerability scanners or integrity checkers (e.g., Qualys, Tenable, or custom PowerShell scripts) periodically scan