ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving known Cobalt Strike indicators of compromise (IOCs), which are frequently utilized by threat actors to establish command and control channels during post-exploitation phases. Proactively hunting for these signatures in Azure Sentinel is critical because Cobalt Strike serves as a versatile tool for lateral movement and data exfiltration, allowing the SOC team to rapidly detect and contain active intrusions before they escalate.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 11 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`149[.]88[.]66[.]234:8443`	botnet_cc	2026-08-18	100%
ip:port	`110[.]42[.]255[.]63:123`	botnet_cc	2026-08-18	100%
ip:port	`110[.]42[.]255[.]63:8080`	botnet_cc	2026-08-18	100%
ip:port	`110[.]42[.]255[.]63:443`	botnet_cc	2026-08-18	100%
ip:port	`156[.]224[.]18[.]21:995`	botnet_cc	2026-08-18	100%
ip:port	`43[.]139[.]87[.]203:3001`	botnet_cc	2026-08-18	100%
ip:port	`38[.]76[.]183[.]197:3478`	botnet_cc	2026-08-18	100%
ip:port	`38[.]76[.]183[.]197:10086`	botnet_cc	2026-08-18	100%
ip:port	`38[.]76[.]183[.]197:80`	botnet_cc	2026-08-18	100%
ip:port	`38[.]76[.]183[.]197:8080`	botnet_cc	2026-08-18	100%
ip:port	`103[.]236[.]84[.]103:80`	botnet_cc	2026-08-18	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["43.139.87.203", "149.88.66.234", "103.236.84.103", "38.76.183.197", "156.224.18.21", "110.42.255.63"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["43.139.87.203", "149.88.66.234", "103.236.84.103", "38.76.183.197", "156.224.18.21", "110.42.255.63"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Scheduled Vulnerability Scanning via Nessus or Qualys
- Context: Enterprise vulnerability scanners (e.g., Tenable Nessus, Qualys Cloud Agent) frequently utilize the same network ports (typically 80/443 with specific User-Agent strings) and beaconing intervals that mimic Cobalt Strike’s C2 traffic. The scanner’s heartbeat mechanism often matches the IOCs for “beacon frequency” and “TLS handshake patterns.”
- Filter/Exclusion: Create an exclusion rule based on the source IP range of the vulnerability management servers (e.g., 10.50.20.x) or filter alerts where the process name is explicitly nessus.exe, qualyspc.exe, or tsc_agent.
Scenario: Admin Remote Management via Microsoft System Center Configuration Manager (SCCM)
- Context: SCCM agents perform regular policy checks and software deployment tasks that generate network traffic indistinguishable from Cobalt Strike beacons. The “C2 beacon” IOC often triggers when the SCCM client (ccmexec.exe) initiates a connection to the management point using similar TLS cipher suites and timing windows defined in the rule logic.
- Filter/Exclusion: Exclude alerts where the parent process is ccmsetup.exe or ccmexec.exe. Additionally, add a filter for specific destination IP addresses belonging to the internal SCCM site server infrastructure.
Scenario: Automated Backup Jobs Using Veeam or Commvault
- Context: Enterprise backup solutions often run scheduled jobs during off-hours that establish persistent connections to central repositories. These jobs utilize HTTP/HTTPS polling mechanisms that align with Cobalt Strike