ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This rule detects the presence of known Cobalt Strike indicators of compromise, which adversaries frequently deploy to establish command-and-control channels and execute post-exploitation activities within the network. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify active or dormant implants before they can be leveraged for lateral movement or data exfiltration, reducing the mean time to detection for high-severity threats.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["123.60.102.111", "156.239.4.189", "8.148.241.203"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["123.60.102.111", "156.239.4.189", "8.148.241.203"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Cobalt Strike

False Positive Guidance

• Scenario: A DevOps engineer uses the beacon binary (or a renamed variant) as a lightweight, cross-platform remote execution tool for ad-hoc script deployment during a maintenance window, rather than for its intended C2 purpose.
  • Filter/Exclusion: Exclude processes where the parent process is a known CI/CD agent (e.g., jenkins.exe, gitlab-runner.exe, azure-pipelines-agent.exe) or where the command line contains specific internal script paths (e.g., C:\Scripts\Deploy\*.ps1).
• Scenario: An IT support team deploys a custom PowerShell wrapper that mimics Cobalt Strike’s beacon functionality to push updates to a fleet of legacy Windows 7 endpoints that cannot run standard WMI or PSExec, using a renamed binary to avoid antivirus heuristics.
  • Filter/Exclusion: Exclude processes running from the C:\ProgramData\ITSupport\ directory or where the parent process is powershell.exe and the command line includes the internal parameter -InternalDeploy.
• Scenario: A security team runs a scheduled vulnerability scan using a commercial tool (e.g., Qualys, Tenable) that bundles a Cobalt Strike-based agent for deep packet inspection or credential harvesting tests in a controlled test lab environment.
  • Filter/Exclusion: Exclude processes where the parent process is the scanner’s main executable (e.g., qualys_agent.exe, tenable_agent.exe) or where the process path resides within the scanner’s installation directory (e.g., C:\Program Files\Qualys\).
• Scenario: A developer tests a new .NET application that dynamically loads a Cobalt Strike beacon library (beacon.dll) for integration testing in a local development VM, where the process is short-lived and terminated by the IDE.

  ---