ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving known Cobalt Strike indicators of compromise, which are frequently utilized by threat actors to establish command and control channels during post-exploitation phases. Proactively hunting for these IOCs within Azure Sentinel is critical because early identification of this widely adopted toolset enables the SOC team to rapidly isolate compromised assets before adversaries can execute lateral movement or data exfiltration campaigns.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 8 IOC Types: sha256_hash, ip:port, md5_hash, sha1_hash

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["38.244.52.101"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["38.244.52.101"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Cobalt Strike
let malicious_hashes = dynamic(["9a7fdfd933725c6cc3345da81b6ee2d6903e225f961aa18efa5b5a9447f4b015", "30bc73c6672e6c46d21086a04762ce4170fd4e99", "a3db22547419f693905d3dd045ee9f84"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Cobalt Strike

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Legitimate Patch Management Scans

  • Context: Enterprise patch management tools like Microsoft SCCM (Configuration Manager) or Ivanti Neurons frequently initiate network discovery scans that mimic Cobalt Strike’s beacon traffic patterns. These tools often use similar port ranges and packet structures when polling endpoints for inventory updates, triggering the IOC logic.
  • Suggested Filter/Exclusion: Create an exclusion based on the source IP range of the patch management servers (e.g., 10.20.50.0/24) or filter out traffic where the User-Agent string contains specific identifiers like “CCMExec” or “IvantiPatch”.

• Scenario: Scheduled Automated Backup Jobs

  • Context: Enterprise backup solutions such as Veeam Backup & Replication or Commvault run scheduled jobs during off-hours that establish persistent connections to multiple endpoints. These jobs often utilize the same communication protocols and timing intervals observed in Cobalt Strike beacons, leading to high-volume detection matches.
  • Suggested Filter/Exclusion: Implement a time-based exclusion for known backup windows (e.g., 02:00–06:00 daily) or exclude traffic originating from the specific Service Accounts used by the backup software (e.g., DOMAIN\svc-veeam-backup).

• Scenario: Internal Security Scanning and EDR Telemetry

  • Context: The organization’s internal Endpoint Detection and Response (EDR) agent, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs periodic network connectivity checks and threat intelligence queries. These agents often generate traffic signatures that overlap