ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of Cobalt Strike beacons by identifying three specific indicators of compromise that signal active command and control infrastructure within the network. The SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly identify and contain potential post-exploitation activities before adversaries can establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["8.163.59.20", "43.225.157.17", "38.190.196.19"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["8.163.59.20", "43.225.157.17", "38.190.196.19"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Cobalt Strike

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Internal Patch Management Deployment

  • Context: The organization uses Microsoft Endpoint Configuration Manager (SCCM) or Ivanti Neurons to deploy security updates. These tools often utilize a custom beacon process that mimics the Cobalt Strike “beacon” architecture, generating network traffic and file hashes identical to the rule’s IOCs during scheduled maintenance windows.
  • Filter/Exclusion: Exclude alerts where the source IP belongs to the internal patch management subnet (e.g., 10.x.x.0/24) AND the process name matches known enterprise deployment agents like ccmexec.exe or ivanti_agent.exe. Additionally, suppress alerts occurring during defined maintenance windows (e.g., Sundays 02:00–06:00 UTC).

• Scenario: Automated Backup and Archiving Jobs

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault frequently create temporary executable wrappers to manage data transfer. These wrappers often spawn child processes that exhibit the same file signatures (SHA256) and network behavior patterns as Cobalt Strike beacons, particularly when compressing large datasets over the WAN.
  • Filter/Exclusion: Create a whitelist for specific backup service accounts (e.g., DOMAIN\VeeamService) and exclude any alerts where the parent process is identified as vbr.exe or commvault_agent. Filter out events where the destination port is restricted to known backup ports (e.g., TCP 9400, 2516) rather than the standard Cobalt Strike beacon port range.

• Scenario: DevOps CI/CD Pipeline Execution