ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hypothesis targets the presence of Cobalt Strike indicators, which adversaries frequently deploy to establish command-and-control channels, execute post-exploitation actions, and maintain persistent access within the network. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints early, potentially disrupting the attacker’s ability to exfiltrate data or escalate privileges before they achieve their full operational objectives.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["117.50.180.204", "124.223.188.23"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["117.50.180.204", "124.223.188.23"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Cobalt Strike

False Positive Guidance

• Legitimate Penetration Testing and Red Team Exercises

  • Scenario: Internal security teams or contracted third-party firms (e.g., CrowdStrike, Rapid7) conduct scheduled penetration tests or red team engagements. They deploy Cobalt Strike Beacons to simulate attacker post-exploitation movements, such as lateral movement via psexec or credential dumping, which matches the IOCs (e.g., specific hash values, process names like beacon.exe, or known C2 callback patterns).
  • Filter/Exclusion: Exclude hosts or user accounts tagged with a CMDB attribute like AssetType = "PenTest" or Role = "RedTeam". Additionally, create a time-based exclusion window (e.g., TimeRange = [2024-05-01, 2024-05-15]) during known engagement periods, or whitelist specific IP ranges associated with the testing team’s jump hosts.

• Development and QA Environment Load/Stress Testing

  • Scenario: DevOps or QA engineers use Cobalt Strike in non-production environments (Dev, Staging, or QA) to simulate high-concurrency network traffic, test firewall rules, or validate incident response playbooks. The tool may be run from developer workstations or CI/CD pipeline runners, triggering alerts for unusual outbound connections or process execution patterns that resemble malicious behavior.
  • Filter/Exclusion: Exclude all hosts within the Dev, Staging, or QA subnets (e.g., IPRange = 10.20.0.0/16). Alternatively, exclude processes launched by specific service accounts used for automated testing (e.g., AccountName = "svc-ci-pipeline" or AccountName = "qa-automation-bot").

• Legacy Application Maintenance and Patching *