ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This rule detects adversary behavior involving the deployment of Cobalt Strike tools by matching six specific indicators of compromise known to facilitate command and control or lateral movement activities. SOC teams should proactively hunt for these IOCs in Azure Sentinel because early identification of Cobalt Strike artifacts is critical to disrupting advanced persistent threats that leverage this widely used post-exploitation framework.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 6 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`36[.]133[.]104[.]91:8080`	botnet_cc	2026-09-01	100%
ip:port	`36[.]133[.]104[.]91:443`	botnet_cc	2026-09-01	100%
ip:port	`36[.]133[.]104[.]91:80`	botnet_cc	2026-09-01	100%
ip:port	`36[.]133[.]104[.]91:8888`	botnet_cc	2026-09-01	100%
ip:port	`103[.]6[.]169[.]62:18443`	botnet_cc	2026-09-01	50%
ip:port	`62[.]72[.]42[.]58:22`	botnet_cc	2026-09-01	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["103.6.169.62", "36.133.104.91", "62.72.42.58"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["103.6.169.62", "36.133.104.91", "62.72.42.58"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule, along with suggested filters or exclusions tailored for an enterprise environment:

Scenario: Scheduled Vulnerability Scanning via Tenable Nessus
- Context: The enterprise runs nightly vulnerability scans using Tenable Nessus. The scanner’s agent often establishes network connections to the central management server that mimic Cobalt Strike’s beacon traffic patterns, specifically triggering IOCs related to specific User-Agent strings or connection intervals.
- Filter/Exclusion: Create a rule exclusion based on the source hostname containing tenable-scanner-* and restrict the detection window to exclude the defined maintenance window (e.g., 02:00–04:00 UTC).
Scenario: Automated Patch Deployment via SCCM
- Context: Microsoft Endpoint Configuration Manager (SCCM) pushes software updates during business hours. The deployment engine utilizes a communication protocol that generates network signatures identical to Cobalt Strike’s command-and-control (C2) heartbeat, particularly when downloading large payloads from the distribution point.
- Filter/Exclusion: Exclude traffic originating from the SCCM Distribution Point IP range (10.20.30.x) and filter out processes where the executable path matches C:\Program Files\Microsoft Configuration Manager\ccmsetup.exe.
Scenario: Internal Backup Jobs Using Veeam
- Context: Veeam Backup & Replication initiates daily backup jobs that involve agents polling a central console. The agent’s network handshake and periodic status reporting can trigger IOCs associated with Cobalt Strike’s beacon interval logic, especially when the job involves transferring metadata over HTTPS.
- Filter/Exclusion: Implement an exclusion for process names containing VeeamAgent.exe or `Veeam