ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving specific Indicators of Compromise (IOCs) linked to the Cobalt Strike toolset, which is frequently utilized by threat actors for command and control operations during post-exploitation phases. Proactively hunting for these signatures in Azure Sentinel enables the SOC team to rapidly detect stealthy lateral movement or data exfiltration attempts that may evade standard signature-based defenses.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 6 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`207[.]57[.]134[.]202:3306`	botnet_cc	2026-08-06	100%
ip:port	`154[.]221[.]25[.]38:443`	botnet_cc	2026-08-06	100%
ip:port	`83[.]229[.]123[.]185:443`	botnet_cc	2026-08-06	100%
ip:port	`36[.]140[.]162[.]173:11443`	botnet_cc	2026-08-06	100%
ip:port	`78[.]17[.]93[.]55:10443`	botnet_cc	2026-08-06	50%
ip:port	`146[.]56[.]195[.]201:4433`	botnet_cc	2026-08-06	50%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["83.229.123.185", "146.56.195.201", "154.221.25.38", "36.140.162.173", "78.17.93.55", "207.57.134.202"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["83.229.123.185", "146.56.195.201", "154.221.25.38", "36.140.162.173", "78.17.93.55", "207.57.134.202"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Cobalt Strike IOCs detection rule in an enterprise environment:

Scenario: Automated Vulnerability Scanning by Qualys or Tenable
- Context: Enterprise vulnerability scanners (e.g., Qualys Cloud Agent, Tenable Nessus) often utilize Cobalt Strike’s underlying beacon technology or similar network libraries to perform active host discovery and asset inventory. These tools may generate the specific IOCs (such as distinct User-Agent strings or specific registry keys) that the rule flags as suspicious.
- Filter/Exclusion: Exclude processes where the executable path matches known scanner agents, such as C:\Program Files\Qualys\PC Agent\pc-agent.exe or C:\Program Files\Tenable\Nessus Agent\nsa.exe. Additionally, filter out events originating from the “System” account when running these specific services.
Scenario: Scheduled Backup Jobs using Veeam or Commvault
- Context: Legacy backup solutions like Veeam Backup & Replication or Commvault often deploy a management agent that mimics Cobalt Strike’s network behavior to communicate with the central console. These agents frequently run as scheduled tasks during off-hours, triggering IOCs related to outbound connections on standard ports (e.g., 80/443) and specific DLL injection patterns associated with the beacon.
- Filter/Exclusion: Create an exclusion for events where the parent process is vbrsrv.exe (Veeam) or cmdAgent.exe (Commvault). Furthermore, exclude alerts triggered by the “Network Service” account during the defined maintenance window (e.g., 02:00 – 06:00 local time).
Scenario: Internal DevOps CI/CD Pipelines running Jenkins or GitLab Runners *