ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This rule detects the presence of known Cobalt Strike indicators of compromise, signaling that an adversary may have deployed a powerful post-exploitation framework to establish command-and-control or execute lateral movement. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify and contain stealthy, high-severity intrusions before they can escalate privileges or exfiltrate sensitive data.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["124.221.4.84", "39.100.66.238"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["124.221.4.84", "39.100.66.238"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Cobalt Strike

False Positive Guidance

• Legitimate Internal Tooling (Beacon/Beacon-HTTP): Security teams or DevOps engineers often deploy custom internal tools, CI/CD agents, or monitoring scripts that use HTTP/S beaconing patterns similar to Cobalt Strike for health checks or data exfiltration to internal dashboards.
  • Filter/Exclusion: Exclude known internal management IPs or specific service accounts (e.g., svc-ci-deploy, monitoring-agent) from the IOC match, or whitelist specific hash values associated with internal build artifacts.
• Scheduled Maintenance Jobs (PowerShell/Python Scripts): Automated scheduled tasks (e.g., via Windows Task Scheduler or cron) that execute PowerShell or Python scripts for log rotation, database backups, or configuration pushes may generate network connections or process creation patterns that mimic Cobalt Strike’s beacon or shell commands.
  • Filter/Exclusion: Exclude processes initiated by Task Scheduler (taskschd.msc) or specific parent processes like svchost.exe with known service names, or filter out connections to internal storage endpoints (e.g., 10.0.x.x range) when the source is a known backup server.
• Third-Party SaaS Agents (Zoom/Teams/Slack): Enterprise SaaS applications like Zoom, Microsoft Teams, or Slack install background agents that maintain persistent HTTPS connections and may spawn child processes for media handling or updates, potentially matching generic Cobalt Strike IOCs related to outbound HTTPS or process injection.
  • Filter/Exclusion: Exclude known SaaS application binaries (e.g., Zoom.exe, Teams.exe, slack.exe) and their associated child processes, or filter out connections to known SaaS CDNs (e.g., *.zoom.us, *.teams.microsoft.com).
• Development and Testing Environments: Developers or QA engineers running local test harnesses,