ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of Cobalt Strike tools by matching network and host telemetry against a curated set of twelve known indicators of compromise. A SOC team should proactively hunt for these signatures in Azure Sentinel to rapidly identify active post-exploitation frameworks that often serve as the foundation for lateral movement and command-and-control operations within the enterprise environment.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 12 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`43[.]143[.]13[.]146:22`	botnet_cc	2026-08-25	100%
ip:port	`43[.]143[.]13[.]146:8082`	botnet_cc	2026-08-25	100%
ip:port	`43[.]143[.]13[.]146:80`	botnet_cc	2026-08-25	100%
ip:port	`43[.]143[.]13[.]146:443`	botnet_cc	2026-08-25	100%
ip:port	`149[.]88[.]66[.]234:7791`	botnet_cc	2026-08-25	100%
ip:port	`121[.]4[.]38[.]18:443`	botnet_cc	2026-08-25	100%
ip:port	`118[.]24[.]172[.]48:81`	botnet_cc	2026-08-25	100%
ip:port	`47[.]96[.]123[.]205:8000`	botnet_cc	2026-08-25	100%
ip:port	`182[.]92[.]78[.]7:5555`	botnet_cc	2026-08-25	100%
ip:port	`91[.]92[.]240[.]88:443`	botnet_cc	2026-08-25	100%
ip:port	`91[.]92[.]240[.]88:22`	botnet_cc	2026-08-25	100%
ip:port	`91[.]92[.]240[.]88:8080`	botnet_cc	2026-08-25	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["118.24.172.48", "182.92.78.7", "121.4.38.18", "91.92.240.88", "47.96.123.205", "43.143.13.146", "149.88.66.234"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["118.24.172.48", "182.92.78.7", "121.4.38.18", "91.92.240.88", "47.96.123.205", "43.143.13.146", "149.88.66.234"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Here are the documented false positive scenarios and corresponding exclusion strategies for the ThreatFox: Cobalt Strike IOCs detection rule:

Scenario: Legitimate DevOps Pipeline Execution
- Context: The CI/CD pipeline (e.g., Jenkins or GitLab Runner) utilizes a shared service account to deploy applications. This process often involves downloading and executing the beacon.exe artifact from an internal repository, which mimics the Cobalt Strike beacon signature in file hash or network traffic patterns.
- Suggested Filter: Exclude alerts where the parent process is jenkins-agent.exe, gitlab-runner.exe, or dockerd.exe, and the execution path resides within the designated build directory (e.g., C:\Jenkins\workspace\ or D:\GitLab\builds\).
Scenario: Scheduled Endpoint Security Scans
- Context: The enterprise endpoint protection suite (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) performs scheduled deep scans that spawn temporary helper processes. These helpers may generate network connections to internal update servers or load specific DLLs that match the Cobalt Strike IOCs due to overlapping hash values or similar process names used by the security vendor’s own agents.
- Suggested Filter: Create an exclusion for alerts originating from known security service accounts (e.g., CRService, MsMpEng.exe) running under the context of scheduled tasks named “Daily Security Scan” or “Endpoint Health Check.”
Scenario: IT Admin Remote Management Sessions
- Context: System Administrators utilize remote management tools like Microsoft SCCM (System Center Configuration Manager) or Ivanti to push configuration changes. When deploying software updates, the client agent (ccmexec.exe or ivanti_agent) may instantiate a temporary process that matches the Cobalt Strike network beacon signature while communicating with the central management