ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving known Cobalt Strike indicators of compromise (IOCs), which are frequently utilized by threat actors to establish command and control channels during post-exploitation phases. The SOC team should proactively hunt for these signatures in Azure Sentinel because early identification of Cobalt Strike beacons allows for rapid containment of lateral movement attempts before adversaries can fully entrench themselves within the network.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 14 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`68[.]64[.]182[.]169:8010`	botnet_cc	2026-08-13	100%
ip:port	`68[.]64[.]182[.]169:5727`	botnet_cc	2026-08-13	100%
ip:port	`68[.]64[.]182[.]169:111`	botnet_cc	2026-08-13	100%
ip:port	`68[.]64[.]182[.]169:443`	botnet_cc	2026-08-13	100%
ip:port	`68[.]64[.]182[.]169:8080`	botnet_cc	2026-08-13	100%
ip:port	`159[.]75[.]123[.]199:21`	botnet_cc	2026-08-13	100%
ip:port	`68[.]64[.]183[.]127:8090`	botnet_cc	2026-08-13	100%
ip:port	`68[.]64[.]183[.]127:5555`	botnet_cc	2026-08-13	100%
ip:port	`139[.]196[.]217[.]227:80`	botnet_cc	2026-08-13	100%
ip:port	`159[.]75[.]123[.]199:5003`	botnet_cc	2026-08-13	100%
ip:port	`156[.]239[.]47[.]245:80`	botnet_cc	2026-08-13	100%
ip:port	`156[.]239[.]47[.]245:8080`	botnet_cc	2026-08-13	100%
ip:port	`143[.]92[.]60[.]219:6666`	botnet_cc	2026-08-13	50%
ip:port	`68[.]64[.]182[.]169:80`	botnet_cc	2026-08-13	50%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["159.75.123.199", "139.196.217.227", "68.64.182.169", "143.92.60.219", "156.239.47.245", "68.64.183.127"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["159.75.123.199", "139.196.217.227", "68.64.182.169", "143.92.60.219", "156.239.47.245", "68.64.183.127"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Automated Vulnerability Scanning via Tenable Nessus
- Context: The organization runs nightly vulnerability scans using Tenable Nessus. The scanner utilizes a specific network port range (often 4533-4536) and creates temporary executable processes in the C:\Program Files\Tenable\Nessus directory that mimic Cobalt Strike’s beacon behavior.
- Filter/Exclusion: Exclude process paths containing \Tenable\Nessus\ or filter out alerts where the parent process is nessus.exe and the user context is a dedicated service account (e.g., svc_nessus).
Scenario: Scheduled Patch Deployment via Microsoft SCCM
- Context: During off-hours, Microsoft Endpoint Configuration Manager (SCCM) executes scheduled deployment jobs. These jobs often spawn temporary PowerShell scripts or C# executables that establish outbound connections to the distribution point, triggering IOCs related to Cobalt Strike’s command and control (C2) traffic patterns.
- Filter/Exclusion: Create a rule exception for processes originating from C:\Windows\CCM where the process name matches ccmsetup.exe or wuauserv.exe, specifically during the defined maintenance window (e.g., 01:00–04:00 UTC).
Scenario: Internal Remote Support Tool Usage
- Context: The Help Desk team utilizes an internal remote support tool, such as BeyondTrust Remote Support or ConnectWise Control, which employs a similar beacon architecture for agent communication. When agents check in with the central server, they generate network signatures identical to Cobalt Strike’s HTTP