ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of Cobalt Strike tools by identifying matches against a curated set of ten specific indicators of compromise (IOCs) known to be used in active campaigns. A SOC team should proactively hunt for these signatures within Azure Sentinel because Cobalt Strike is a ubiquitous post-exploitation framework frequently leveraged by threat actors to establish persistent command and control channels, making early detection critical for rapid incident response.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 10 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`169[.]58[.]82[.]229:21`	botnet_cc	2026-08-12	100%
ip:port	`169[.]58[.]121[.]189:22`	botnet_cc	2026-08-12	100%
ip:port	`169[.]58[.]121[.]189:222`	botnet_cc	2026-08-12	100%
ip:port	`169[.]58[.]121[.]189:8080`	botnet_cc	2026-08-12	100%
ip:port	`169[.]58[.]121[.]189:80`	botnet_cc	2026-08-12	100%
ip:port	`169[.]58[.]121[.]189:443`	botnet_cc	2026-08-12	100%
ip:port	`169[.]58[.]121[.]189:4443`	botnet_cc	2026-08-12	100%
ip:port	`134[.]199[.]153[.]107:443`	botnet_cc	2026-08-12	100%
ip:port	`43[.]225[.]157[.]17:3970`	botnet_cc	2026-08-12	100%
ip:port	`43[.]225[.]157[.]17:3000`	botnet_cc	2026-08-12	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["134.199.153.107", "169.58.82.229", "43.225.157.17", "169.58.121.189"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["134.199.153.107", "169.58.82.229", "43.225.157.17", "169.58.121.189"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule, along with suggested filters and exclusions tailored for a legitimate enterprise environment:

Scenario: Automated Vulnerability Scanning by Qualys or Tenable
- Context: Enterprise vulnerability scanners (e.g., Qualys Cloud Agent, Tenable Nessus) frequently utilize the same underlying HTTP/HTTPS libraries and C2 beacon patterns as Cobalt Strike to poll for updates and report scan results. These agents often register specific User-Agent strings and connection intervals that match the IOCs in the hunt package.
- Suggested Filter: Exclude network traffic originating from known scanner IP ranges (e.g., 10.50.20.0/24) or filter out processes where the executable name contains “QualysCloudAgent” or “TenableNessus”.
Scenario: Scheduled PowerShell Maintenance Jobs via Task Scheduler
- Context: IT Operations teams often deploy scheduled tasks using powershell.exe to run inventory scripts, patch compliance checks, or log rotation. These scripts frequently invoke the .NET framework and establish outbound connections that mimic Cobalt Strike’s beacon behavior (e.g., periodic HTTP POST requests to internal management servers).
- Suggested Filter: Create an exclusion for processes launched by Task Scheduler (SchTasks.exe) where the command line arguments contain specific keywords like “Inventory,” “Compliance,” or “LogRotate,” and the parent process is a known service account (e.g., DOMAIN\svc-maintenance).
Scenario: Endpoint Detection and Response (EDR) Telemetry Uploads
- Context: Modern EDR solutions (such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) continuously upload telemetry data to their cloud management consoles. The communication patterns, including specific port usage (44