ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving known Cobalt Strike indicators of compromise (IOCs) that signal potential command and control or post-exploitation tooling within the network. A proactive hunt is essential in Azure Sentinel to rapidly isolate compromised assets and mitigate lateral movement risks before attackers can establish persistent footholds using this widely adopted red team framework.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 12 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`47[.]238[.]100[.]128:8080`	botnet_cc	2026-07-26	100%
ip:port	`47[.]238[.]100[.]128:80`	botnet_cc	2026-07-26	100%
ip:port	`47[.]238[.]100[.]128:4433`	botnet_cc	2026-07-26	100%
ip:port	`47[.]238[.]100[.]128:443`	botnet_cc	2026-07-26	100%
ip:port	`81[.]70[.]97[.]147:22`	botnet_cc	2026-07-26	100%
ip:port	`106[.]75[.]11[.]70:5357`	botnet_cc	2026-07-26	100%
ip:port	`54[.]178[.]100[.]27:8021`	botnet_cc	2026-07-25	75%
ip:port	`106[.]75[.]11[.]70:47001`	botnet_cc	2026-07-25	100%
ip:port	`106[.]75[.]11[.]70:5986`	botnet_cc	2026-07-25	100%
ip:port	`106[.]75[.]11[.]70:3389`	botnet_cc	2026-07-25	100%
ip:port	`81[.]70[.]21[.]248:8000`	botnet_cc	2026-07-25	100%
ip:port	`114[.]55[.]96[.]192:8888`	botnet_cc	2026-07-25	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["81.70.97.147", "106.75.11.70", "54.178.100.27", "114.55.96.192", "81.70.21.248", "47.238.100.128"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["81.70.97.147", "106.75.11.70", "54.178.100.27", "114.55.96.192", "81.70.21.248", "47.238.100.128"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Cobalt Strike IOCs detection rule:

DevOps Pipeline Artifact Signing
- Scenario: The enterprise CI/CD pipeline (e.g., Jenkins or GitHub Actions) utilizes a custom build agent that signs artifacts using a tool named cobalt or includes a library with the hash matching one of the Cobalt Strike IOCs. This triggers alerts during nightly builds when the signing service executes.
- Suggested Filter: Exclude processes running under the specific CI/CD service account (e.g., svc-jenkins-build) and restrict the detection to exclude execution paths within the build agent directory (e.g., C:\Jenkins\workspace\build-agent\).
Scheduled Endpoint Vulnerability Scanning
- Scenario: The organization runs a scheduled vulnerability assessment using a tool like Tenable Nessus or Qualys. During the scan, the agent injects a temporary beacon process that shares a file hash with Cobalt Strike’s beacon.dll or cobalt.exe. This occurs daily at 02:00 AM across all managed workstations.
- Suggested Filter: Create an exclusion for processes spawned by the specific vulnerability scanner executable (e.g., TenableAgent.exe) and filter out alerts occurring during the defined maintenance window (01:30–02:30 UTC).
Internal Security Tooling Deployment
- Scenario: The internal security team deploys a custom monitoring agent named “Cobalt-Sentinel” for real-time log aggregation. This tool utilizes a shared binary that matches the IOCs defined in the ThreatFox rule, triggering alerts whenever the agent refreshes its configuration or connects to the central collector.
- Suggested Filter: Whitelist the specific process name `CobaltSentinel