ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt detects adversary behavior characterized by the deployment of Cobalt Strike beacons and their associated infrastructure indicators across the network. A SOC team should proactively search for these signals in Azure Sentinel to identify early-stage post-exploitation activities that often precede lateral movement and data exfiltration campaigns.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 12 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`185[.]182[.]65[.]34:8080`	botnet_cc	2026-08-03	100%
ip:port	`185[.]182[.]65[.]34:443`	botnet_cc	2026-08-03	100%
ip:port	`154[.]12[.]94[.]16:8080`	botnet_cc	2026-08-03	100%
ip:port	`154[.]12[.]94[.]16:443`	botnet_cc	2026-08-03	100%
ip:port	`154[.]12[.]94[.]16:80`	botnet_cc	2026-08-03	100%
ip:port	`156[.]239[.]47[.]223:8082`	botnet_cc	2026-08-03	100%
ip:port	`156[.]239[.]47[.]223:888`	botnet_cc	2026-08-03	100%
ip:port	`156[.]239[.]47[.]223:22`	botnet_cc	2026-08-03	100%
ip:port	`156[.]239[.]47[.]223:3389`	botnet_cc	2026-08-03	100%
ip:port	`156[.]239[.]47[.]223:8080`	botnet_cc	2026-08-03	100%
ip:port	`156[.]239[.]47[.]223:80`	botnet_cc	2026-08-03	100%
ip:port	`156[.]239[.]47[.]223:443`	botnet_cc	2026-08-03	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["185.182.65.34", "156.239.47.223", "154.12.94.16"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["185.182.65.34", "156.239.47.223", "154.12.94.16"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Automated Vulnerability Scanning by Qualys or Tenable
- Context: Enterprise vulnerability scanners often utilize a shared beacon process (similar to beacon.exe) that mimics the Cobalt Strike architecture. When these tools run scheduled scans, they may establish network connections to known update servers or download modules that match the 12 IOCs in the hunt package.
- Filter/Exclusion: Exclude processes where the file path matches the standard installation directory of approved scanners (e.g., C:\Program Files\Qualys\Agent\ or C:\Tenable\Network Security Scanner\) and the process name is known (e.g., qualyspc.exe, tenable_agent.exe).
Scenario: Microsoft Endpoint Configuration Manager (SCCM) Deployment
- Context: During software deployment tasks, SCCM creates temporary worker processes that download content from distribution points. These processes often utilize similar network signatures and file hashes as Cobalt Strike beacons when pulling payloads or reporting status to the management point.
- Filter/Exclusion: Create a whitelist for process names starting with ccmexec.exe or wuauserv.exe running under the SYSTEM account, specifically filtering out events where the parent process is SMS_EXEC_HOST.
Scenario: Scheduled PowerShell Maintenance Jobs
- Context: IT operations teams frequently schedule PowerShell scripts to perform health checks, log rotation, or configuration backups. These scripts often invoke external tools or download modules that trigger network traffic patterns identical to Cobalt Strike’s command and control (C2) channels.
- Filter/Exclusion: Exclude events where the parent process is `powers