ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of Cobalt Strike tools by identifying three specific indicators of compromise (IOCs) that signal potential command and control or post-exploitation activities within the environment. A SOC team should proactively hunt for these signals in Azure Sentinel to rapidly identify and isolate active Cobalt Strike implants, thereby mitigating the risk of lateral movement and data exfiltration before they escalate into a full-scale breach.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 3 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`47[.]84[.]15[.]240:8080`	botnet_cc	2026-08-15	100%
ip:port	`47[.]84[.]15[.]240:80`	botnet_cc	2026-08-15	100%
ip:port	`47[.]84[.]15[.]240:443`	botnet_cc	2026-08-14	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["47.84.15.240"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["47.84.15.240"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

False Positive Scenarios for “ThreatFox: Cobalt Strike IOCs” Detection Rule

Scenario: Legitimate Software Deployment via SCCM/Intune
- Context: Enterprise IT teams frequently use Microsoft Endpoint Configuration Manager (SCCM) or Intune to deploy the latest version of Cobalt Strike as a standard tool for internal network assessments. During these scheduled deployments, the installer may extract the beacon executable and associated DLLs that match the rule’s IOCs.
- Suggested Filter: Exclude processes where the parent process is ccmsetup.exe (SCCM) or IntuneManagementExtension.exe, and restrict the detection to non-standard installation paths (e.g., exclude C:\Program Files\Microsoft Endpoint Configuration Manager).
Scenario: Scheduled Internal Vulnerability Scanning
- Context: Security teams often schedule automated vulnerability scans using tools like Tenable Nessus or Qualys, which may utilize Cobalt Strike agents to perform active network mapping and host discovery. These scheduled jobs run nightly and generate the specific IOCs (such as beacon.exe with specific command-line arguments) during their execution window.
- Suggested Filter: Create a time-based exclusion for the rule between 01:00 AM and 05:00 AM on weekdays, or filter out events where the process path contains \Tenable\ or \Qualys\ directories.
Scenario: DevOps Pipeline Execution in CI/CD Environments
- Context: In development environments, Jenkins or GitLab Runners often spin up temporary containers or agents to execute security testing scripts. These pipelines may download and run Cobalt Strike binaries as part of a “Security Gate” stage, triggering the IOCs within the build agent’s workspace directory rather than on user endpoints.
- Suggested Filter: Exclude events