ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This detection rule identifies adversary behavior characterized by the execution of Cobalt Strike tools, which are frequently utilized for command and control (C2) and post-exploitation activities within compromised networks. A SOC team should proactively hunt for these specific indicators in Azure Sentinel to rapidly detect early-stage lateral movement and establish a baseline for distinguishing legitimate administrative traffic from malicious C2 communications.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 7 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["8.137.149.67", "43.139.108.161", "106.75.11.70", "47.92.208.27", "47.101.51.235", "103.86.65.202"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["8.137.149.67", "43.139.108.161", "106.75.11.70", "47.92.208.27", "47.101.51.235", "103.86.65.202"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Cobalt Strike
let malicious_domains = dynamic(["cdn.pixelcss.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Cobalt Strike

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Automated Patch Deployment via SCCM/Intune

  • Context: Enterprise Configuration Management tools (e.g., Microsoft Endpoint Configuration Manager or Intune) often utilize the same underlying HTTP beaconing patterns and specific User-Agent strings that Cobalt Strike uses to communicate with its C2 server. When these agents poll for updates or report status, they may match the rule’s IOCs regarding network traffic signatures.
  • Suggested Filter: Exclude traffic originating from known management subnets (e.g., 10.50.x.x) where SCCM/Intune servers reside, or filter by specific Service Principal Names (SPN) associated with the patching service accounts if the IOC includes authentication tokens.

• Scenario: Scheduled PowerShell Health Checks

  • Context: IT Operations teams frequently schedule recurring PowerShell scripts to check server health, disk usage, or backup status. These scripts often invoke Invoke-WebRequest or curl commands that generate HTTP POST requests with headers and payload structures mimicking Cobalt Strike’s beacon traffic, particularly if they connect to internal monitoring dashboards using similar ports (e.g., 80/443).
  • Suggested Filter: Create an exclusion for processes named powershell.exe or pwsh.exe that are launched by the “System” account and originate from a specific “Monitoring” OU (Organizational Unit), provided the destination IP is within the internal monitoring range.

• Scenario: Third-Party RMM Agent Communication

  • Context: Remote Monitoring and Management (RMM) tools like Datto Autopilot, NinjaOne, or ManageEngine Desktop Central install agents on endpoints that maintain