ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of Cobalt Strike beacons, which are frequently utilized by threat actors to establish persistent command and control channels within compromised networks. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early detection enables the SOC team to rapidly isolate affected assets before attackers can execute lateral movement or data exfiltration operations.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["111.229.248.198", "123.184.9.84"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["111.229.248.198", "123.184.9.84"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Cobalt Strike

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• IT Operations Team Executing Patch Management Scripts

  • Scenario: The IT Operations team uses a custom PowerShell script to deploy security patches across 500+ workstations. This script utilizes the Invoke-WebRequest cmdlet to download patch manifests from an internal repository, which inadvertently triggers network traffic patterns (specifically User-Agent strings and TLS handshake behaviors) that match Cobalt Strike’s beacon communication signatures.
  • Filter/Exclusion: Create a whitelist rule excluding traffic originating from the specific Service Account used for patching (e.g., svc-patch-deploy) or filter out connections where the destination IP belongs to the internal Patch Management Server subnet (10.20.45.0/24).

• Scheduled Backup Jobs Utilizing Third-Party Agents

  • Scenario: The enterprise runs nightly backups using Veeam Backup & Replication. During the backup window, the Veeam agent on domain controllers establishes persistent connections to the central management server and performs heartbeat checks. These heartbeats utilize specific TCP ports and periodic intervals that closely mimic Cobalt Strike’s “beacon” callback mechanism, causing the detection logic to flag them as potential command-and-control (C2) activity.
  • Filter/Exclusion: Exclude processes with the executable name VeeamAgent.exe or vbragent.exe running under the NT AUTHORITY\SYSTEM context. Additionally, add a time-based filter to suppress alerts for this rule between 01:00 and 05:00 UTC when backup jobs are active.

• Software Development Teams Running CI/CD Pipeline Agents

  • Scenario: The DevOps team utilizes **J