ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This rule detects the presence of known Cobalt Strike indicators of compromise, which adversaries frequently use to establish command-and-control channels and execute post-exploitation activities. Proactively hunting for these IOCs allows the SOC to identify compromised assets early, as Cobalt Strike is a prevalent tool in advanced persistent threats that can enable lateral movement and data exfiltration within the Azure environment.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 7 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`47[.]243[.]191[.]83:88`	botnet_cc	2026-09-16	100%
ip:port	`144[.]225[.]246[.]14:80`	botnet_cc	2026-09-16	100%
ip:port	`144[.]225[.]246[.]14:443`	botnet_cc	2026-09-16	100%
ip:port	`47[.]98[.]124[.]244:80`	botnet_cc	2026-09-16	100%
ip:port	`8[.]146[.]227[.]247:8082`	botnet_cc	2026-09-16	100%
ip:port	`156[.]239[.]224[.]131:80`	botnet_cc	2026-09-16	50%
ip:port	`42[.]193[.]227[.]214:1002`	botnet_cc	2026-09-16	50%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["8.146.227.247", "144.225.246.14", "156.239.224.131", "47.98.124.244", "47.243.191.83", "42.193.227.214"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["8.146.227.247", "144.225.246.14", "156.239.224.131", "47.98.124.244", "47.243.191.83", "42.193.227.214"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Legitimate Internal Red Teaming or Penetration Testing
- Scenario: An internal security team or contracted pen tester uses Cobalt Strike for authorized assessments, intentionally generating beacon traffic, specific hash patterns, or known IOCs (e.g., specific beacon.exe hashes or malleable C2 profiles) that match the ThreatFox feed.
- Filter/Exclusion: Exclude alerts where the source IP is within the designated internal security lab subnet (e.g., 10.50.0.0/24) or where the user account belongs to the SEC-RedTeam group. Additionally, correlate with a change management ticket ID in the CMDB for the specific date range.
Legacy Application Update Mechanisms
- Scenario: A legacy line-of-business application (e.g., an older version of a proprietary ERP module or industrial control system client) uses a custom update script that downloads a binary or script with a hash or URL pattern that coincidentally matches one of the 7 IOCs (e.g., a generic update.exe hash or a specific http:// endpoint).
- Filter/Exclusion: Exclude alerts where the process name is app_update_service.exe or the parent process is the known legacy application executable (e.g., legacy_erp_client.exe). Verify the file path is under the application’s installation directory (e.g., C:\Program Files\LegacyERP\bin\).
Scheduled Maintenance Jobs with Known Binaries
- Scenario: A scheduled task (e.g., DailyBackupSync or LogRotation) executes a utility binary (e.g., rsync.exe, robocopy.exe, or a custom sync_tool.exe) that has a known hash matching one of the IOCs, or connects to an internal file server endpoint that matches