ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt targets adversary behavior characterized by the deployment of Cobalt Strike beacons, which are frequently utilized for command-and-control communication and lateral movement within compromised networks. Proactively hunting for these specific IOCs in Azure Sentinel is critical to rapidly identify active post-exploitation campaigns before adversaries can establish persistent footholds or exfiltrate sensitive data.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 6 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["134.175.8.102", "8.141.123.117", "114.132.89.132", "118.99.3.219", "3.29.91.108"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["134.175.8.102", "8.141.123.117", "114.132.89.132", "118.99.3.219", "3.29.91.108"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Cobalt Strike
let malicious_domains = dynamic(["e365aac901114d3db00d42b59e56a037-cn-hangzhou.alicloudapi.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Cobalt Strike

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Endpoint Detection & Response (EDR) Telemetry Collection

  • Scenario: The EDR agent (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) periodically scans the C:\Program Files\Cobalt Strike\ directory to update its local threat intelligence database. This activity generates file access and hash verification events that match the Cobalt Strike beacon IOCs, even though no active attack is occurring.
  • Filter/Exclusion: Create an exclusion for processes running under the specific EDR service account (e.g., NT SERVICE\CrowdStrikeService or Microsoft Defender Antivirus) accessing files within known installation paths (C:\Program Files\Cobalt Strike\).

• Software Deployment via Configuration Management

  • Scenario: During a scheduled maintenance window, the IT team uses Ansible or SCCM (System Center Configuration Manager) to deploy security patches to the Cobalt Strike server. The deployment scripts execute commands that instantiate temporary beacon-like processes to verify connectivity and configuration integrity, triggering the detection logic.
  • Filter/Exclusion: Exclude events where the parent process is a known deployment tool (e.g., Ansible.exe, ccmexec.exe) or where the command line arguments contain specific deployment tags (e.g., --task=patch-deploy or -DeployMode).

• Automated Backup and Snapshot Operations

  • Scenario: A scheduled Veeam Backup & Replication job runs nightly to snapshot the virtual machine hosting the Cobalt Strike infrastructure. The backup agent interacts with the Cobalt Strike executable and its configuration files (beacon.conf, cs.bat) to ensure data consistency, mimicking the file