ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt detects adversary activity involving known Cobalt Strike indicators of compromise (IOCs) that signal potential command-and-control infrastructure or post-exploitation tooling within the network. Proactively hunting for these signatures in Azure Sentinel is critical to identify early-stage lateral movement and establish a rapid response capability against this widely used attacker framework before it escalates into a broader breach.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 7 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`151[.]245[.]230[.]21:22`	botnet_cc	2026-08-29	100%
ip:port	`115[.]159[.]226[.]190:54321`	botnet_cc	2026-08-29	100%
ip:port	`157[.]66[.]26[.]124:80`	botnet_cc	2026-08-29	50%
ip:port	`154[.]37[.]218[.]73:12580`	botnet_cc	2026-08-29	50%
ip:port	`43[.]143[.]13[.]146:8888`	botnet_cc	2026-08-29	100%
ip:port	`121[.]4[.]38[.]18:22`	botnet_cc	2026-08-29	100%
ip:port	`8[.]134[.]166[.]14:54451`	botnet_cc	2026-08-28	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["157.66.26.124", "154.37.218.73", "121.4.38.18", "8.134.166.14", "151.245.230.21", "43.143.13.146", "115.159.226.190"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["157.66.26.124", "154.37.218.73", "121.4.38.18", "8.134.166.14", "151.245.230.21", "43.143.13.146", "115.159.226.190"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs rule, including targeted filters and exclusions suitable for an enterprise environment:

Scenario: Automated Patch Management Deployment
- Context: Enterprise patching tools like Microsoft Endpoint Configuration Manager (SCCM) or Ivanti Neurons often deploy the beacon.exe payload to endpoints during scheduled maintenance windows. These deployments mimic Cobalt Strike’s beacon behavior by establishing persistent connections and executing remote commands, triggering IOCs related to process creation and network connectivity.
- Filter/Exclusion: Create an exclusion based on the Parent Process Name (ccmsetup.exe, IvantiAgent.exe) and restrict detection to specific Maintenance Windows (e.g., 02:00–04:00 UTC). Additionally, exclude known Hashes of legitimate patching agents from the IOC list.
Scenario: Internal DevOps CI/CD Pipeline Execution
- Context: Internal build servers running Jenkins, GitLab Runners, or Azure DevOps Agents frequently utilize Cobalt Strike-style communication patterns to orchestrate builds and deployments. These agents often spawn child processes that match the beacon signature while communicating with internal artifact repositories, generating false positives for command execution and network beaconing.
- Filter/Exclusion: Implement a filter excluding traffic originating from specific Internal IP Ranges (e.g., the DevOps subnet) or where the Source Hostname matches known build server naming conventions (e.g., *-jenkins-runner, gitlab-agent-*).
Scenario: Scheduled Enterprise Backup and Monitoring Jobs
- Context: Legacy backup solutions like Veeam Backup & Replication or monitoring suites such as SolarWinds NPM often utilize custom agents that