ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of Cobalt Strike beacons by identifying four specific indicators of compromise within network and endpoint telemetry. A SOC team should proactively hunt for these signals in Azure Sentinel to rapidly identify active post-exploitation tooling that often signifies a sophisticated attacker establishing persistent command-and-control channels.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`38[.]207[.]177[.]165:80`	botnet_cc	2026-08-19	100%
ip:port	`38[.]207[.]177[.]165:443`	botnet_cc	2026-08-19	100%
ip:port	`45[.]221[.]118[.]46:8080`	botnet_cc	2026-08-19	100%
ip:port	`147[.]139[.]245[.]149:801`	botnet_cc	2026-08-19	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["38.207.177.165", "147.139.245.149", "45.221.118.46"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["38.207.177.165", "147.139.245.149", "45.221.118.46"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

False Positive Scenarios for “ThreatFox: Cobalt Strike IOCs”

Scenario: Legitimate CI/CD Pipeline Execution
- Context: The enterprise DevOps team utilizes Jenkins or GitLab Runners to deploy applications. These runners often execute PowerShell scripts that invoke System.Net.HttpWebRequest or similar .NET assemblies to fetch build artifacts, which share network signatures (e.g., specific User-Agent strings or certificate thumbprints) with Cobalt Strike’s beacon communication.
- Suggested Filter: Exclude processes originating from known CI/CD service accounts (e.g., svc-jenkins, gitlab-runner) and restrict the rule to exclude traffic destined for internal artifact repositories (e.g., Artifactory, Nexus) or specific IP ranges of the build farm.
Scenario: Scheduled Software Update & Patching Jobs
- Context: System administrators rely on tools like SCCM (Microsoft Endpoint Configuration Manager), Ivanti, or ManageEngine to push patches and updates during maintenance windows. These agents frequently establish outbound HTTPS connections with specific TLS fingerprints that mimic the Cobalt Strike beacon’s “beacon” traffic pattern, particularly when downloading update manifests from vendor endpoints.
- Suggested Filter: Create an exclusion based on the process image path (e.g., C:\Program Files\Microsoft Endpoint Configuration Manager Client\ccmexec.exe) and exclude scheduled tasks running under the “System” or specific patching service accounts during defined maintenance windows (e.g., 02:00–04:00 UTC).
Scenario: Enterprise RMM & Remote Management Tools
- Context: The IT operations team uses Remote Monitoring and Management (RMM) solutions like Datto RMM, NinjaOne, or ConnectWise Automate to manage endpoint health. These tools maintain persistent background agents that poll the central management server at regular intervals using encrypted