ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt targets adversary behavior characterized by the deployment of Cobalt Strike beacons, which are frequently utilized to establish persistent command and control channels within compromised networks. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early detection of this widely adopted tool allows the SOC team to identify active lateral movement and data exfiltration attempts before they escalate into significant breaches.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`20[.]230[.]138[.]200:81`	botnet_cc	2026-07-20	100%
ip:port	`121[.]40[.]141[.]52:80`	botnet_cc	2026-07-20	100%
ip:port	`216[.]250[.]255[.]1:443`	botnet_cc	2026-07-20	100%
ip:port	`115[.]191[.]29[.]91:5000`	botnet_cc	2026-07-20	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["20.230.138.200", "115.191.29.91", "121.40.141.52", "216.250.255.1"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["20.230.138.200", "115.191.29.91", "121.40.141.52", "216.250.255.1"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Here are four specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule in an enterprise environment, along with recommended filters or exclusions:

Legitimate DevOps Artifact Deployment via Ansible/Terraform
- Scenario: The infrastructure team uses Ansible playbooks to deploy a standardized security monitoring agent (which includes a bundled Cobalt Strike beacon for internal health checks) across 500+ Linux servers. This triggers the rule when the playbook executes curl or wget commands against known ThreatFox IOCs during the initial provisioning phase, specifically on ports 80/443 from the Ansible Control Node’s IP range.
- Filter/Exclusion: Create an exclusion for source IPs belonging to the Ansible Controller subnet (e.g., 10.20.50.0/24) and destination URLs matching the specific artifact repository domain (e.g., *.artifacts.internal.corp). Additionally, filter out events where the user agent string contains “Ansible” or “Terraform”.
Scheduled Patch Management via SCCM/Intune
- Scenario: The monthly patch cycle utilizes Microsoft Endpoint Configuration Manager (SCCM) to push a critical update for a legacy internal application. This application relies on a Cobalt Strike-based communication module that queries the ThreatFox IOC feed to validate certificate revocation lists before applying patches. This activity generates high-volume network traffic matching the 4 IOCs from the System Account (NT AUTHORITY\SYSTEM) on all domain-joined workstations between 02:00 and 04:00 AM local time.
- Filter/Exclusion: Exclude alerts where the Process Name is ccmexec.exe (SCCM) or Microsoft.Windows.Search.exe (Intune), running under the **SYSTEM