ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt targets the presence of known Cobalt Strike indicators, which adversaries frequently deploy to establish command-and-control channels and execute post-compromise actions. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify active or dormant implants before they are leveraged for lateral movement or data exfiltration, reducing the dwell time of sophisticated threat actors.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 7 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["83.229.123.249", "47.109.23.77", "114.66.27.110", "223.109.142.7", "111.228.49.20", "109.236.50.145"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["83.229.123.249", "47.109.23.77", "114.66.27.110", "223.109.142.7", "111.228.49.20", "109.236.50.145"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Cobalt Strike
let malicious_domains = dynamic(["1309673150-86ymvxmhrm.ap-shanghai.tencentscf.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Cobalt Strike

False Positive Guidance

• Legitimate Internal Red Team or Penetration Test: Security teams or contracted vendors often deploy Cobalt Strike beacons to validate detection coverage or simulate attacks.
  • Filter/Exclusion: Exclude source hosts tagged with redteam, pentest, or validation in your CMDB or asset inventory; alternatively, suppress alerts for known test accounts (e.g., svc_redteam, user_pentest) during scheduled test windows.
• Legacy Application Update or Patching Agents: Some older enterprise applications or custom-built patching tools may use Cobalt Strike’s beacon binary or similar naming conventions for their update agents, especially if the vendor uses open-source components or shares binaries with security teams.
  • Filter/Exclusion: Exclude processes matching beacon.exe or cobaltstrike.exe if the parent process is a known update service (e.g., wsus, appdeploy, patchmgr) and the file path resides in a standard application directory (e.g., C:\Program Files\VendorApp\).
• Development or QA Environments: Developers or QA engineers may use Cobalt Strike in isolated lab environments to test client-side security controls or debug network traffic, and these machines may not be fully segmented from production monitoring.
  • Filter/Exclusion: Exclude hosts in the dev, qa, or lab subnets or AD groups; additionally, filter out alerts where the user account belongs to the DevTeam or QATeam security group and the host is not in the production OU.
• Shared Service Accounts with Broad Access: Service accounts used by automation frameworks (e.g., Ansible, Puppet, or custom scripts) may execute Cobalt Strike-derived tools for task orchestration or remote execution, particularly if the tooling is repurposed for internal automation.
  • *