ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of Cobalt Strike tools by identifying ten specific indicators of compromise (IOCs) known to facilitate command and control or lateral movement. A SOC team should proactively hunt for these signatures in Azure Sentinel because early detection of this widely used post-exploitation framework is critical to preventing established threats from escalating into broader network compromises.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 10 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`43[.]139[.]87[.]203:443`	botnet_cc	2026-08-07	100%
ip:port	`43[.]139[.]87[.]203:80`	botnet_cc	2026-08-07	100%
ip:port	`114[.]67[.]204[.]86:443`	botnet_cc	2026-08-07	100%
ip:port	`114[.]67[.]204[.]86:80`	botnet_cc	2026-08-07	100%
ip:port	`114[.]67[.]204[.]86:8080`	botnet_cc	2026-08-07	100%
ip:port	`114[.]67[.]204[.]86:22`	botnet_cc	2026-08-07	100%
ip:port	`154[.]12[.]94[.]16:3389`	botnet_cc	2026-08-07	100%
ip:port	`60[.]247[.]206[.]23:8080`	botnet_cc	2026-08-07	100%
ip:port	`60[.]247[.]206[.]23:443`	botnet_cc	2026-08-07	100%
ip:port	`60[.]247[.]206[.]23:80`	botnet_cc	2026-08-07	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["114.67.204.86", "60.247.206.23", "154.12.94.16", "43.139.87.203"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["114.67.204.86", "60.247.206.23", "154.12.94.16", "43.139.87.203"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Cobalt Strike IOCs detection rule:

Scenario: Automated Software Deployment via SCCM/Intune
- Context: Enterprise Configuration Management tools like Microsoft Endpoint Configuration Manager (SCCM) or Intune often deploy the “Cobalt Strike” client (or similar C2 framework components) as part of a standardized security agent package to thousands of endpoints. The deployment process triggers file creation and network connections matching the Cobalt Strike IOCs.
- Filter/Exclusion: Exclude alerts where the Parent_Process_Name is ccmexec.exe (SCCM), IntuneManagementExtension.exe, or msiexec.exe running under a known Service Account (e.g., DOMAIN\DeploySvc).
Scenario: Scheduled Security Assessment Jobs
- Context: Internal Red Teams or Vulnerability Management groups run scheduled jobs using Cobalt Strike Beacon for periodic penetration testing. These jobs are triggered by Windows Task Scheduler on specific nights, generating the exact IOCs (e.g., specific registry keys or beacon communication patterns) that the rule hunts for.
- Filter/Exclusion: Create a filter to suppress alerts occurring during defined maintenance windows (e.g., Sundays 02:00–06:00 UTC) where the Source_IP belongs to the internal Red Team subnet and the Process_Name matches beacon.exe.
Scenario: Third-Party Endpoint Detection & Response (EDR) Integration
- Context: Certain EDR solutions or specialized security tools (e.g., CrowdStrike Falcon, SentinelOne) utilize a Cobalt Strike-based module for their own telemetry collection or remote command execution. When these agents update or perform health checks, they instantiate processes that mimic the signature of an active Cobalt Strike beacon.