ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt detects adversary behavior indicative of Cobalt Strike beacon deployment by identifying specific Indicators of Compromise (IOCs) known to facilitate command and control communications. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification of this widely used post-exploitation tool allows the SOC team to isolate compromised assets before lateral movement or data exfiltration occurs.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["106.54.44.181", "64.90.13.61", "151.239.24.33"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["106.54.44.181", "64.90.13.61", "151.239.24.33"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Cobalt Strike

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Protection Scanner Updates

  • Scenario: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled daily update. During this process, the agent downloads the latest Cobalt Strike beacon signatures and updates its local definition database, creating network connections to known Cobalt Strike CDN endpoints and generating file hashes that match the rule’s IOCs.
  • Filter/Exclusion: Exclude traffic originating from the specific service accounts used by the EDR agents (e.g., svc_crowdstrike, LocalSystem running MsMpEng.exe) or whitelist the known IP ranges of the EDR vendor’s update servers in the detection logic.

• IT Asset Inventory Scans

  • Scenario: A scheduled vulnerability assessment job runs using tools like Tenable Nessus or Qualys Cloud Agent. These scanners actively probe internal hosts to identify installed software versions and open ports, often generating network traffic patterns (specifically HTTP/HTTPS beaconing) that mimic the communication behavior of a Cobalt Strike team server or beacon check-in.
  • Filter/Exclusion: Create an exclusion for process paths associated with known inventory tools (e.g., C:\Program Files\Tenable\Nessus\nessus.exe or C:\ProgramData\Qualys\Agent\qualys-agent-service.exe) and restrict the rule to only flag traffic originating from user workstations rather than dedicated scan servers.

• Software Deployment via SCCM/Intune

  • Scenario: The IT operations team executes a mass deployment of a new application package using Microsoft Endpoint Configuration Manager (SCCM) or Intune. The deployment agent on client machines establishes persistent connections to the