ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt targets known indicators of compromise associated with Cobalt Strike, a prevalent post-exploitation framework used by adversaries to establish command-and-control channels and execute malicious payloads. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify stealthy lateral movement or persistence mechanisms before they escalate into full-blown breaches, reducing the mean time to detection for high-severity threats.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 7 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`101[.]35[.]217[.]145:50050`	botnet_cc	2026-09-28	50%
ip:port	`114[.]66[.]27[.]110:8434`	botnet_cc	2026-09-28	50%
ip:port	`121[.]127[.]33[.]186:8080`	botnet_cc	2026-09-28	100%
ip:port	`121[.]127[.]33[.]186:80`	botnet_cc	2026-09-28	100%
ip:port	`121[.]127[.]33[.]186:443`	botnet_cc	2026-09-28	100%
ip:port	`121[.]127[.]33[.]186:22`	botnet_cc	2026-09-28	100%
ip:port	`39[.]106[.]219[.]216:443`	botnet_cc	2026-09-28	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["121.127.33.186", "39.106.219.216", "114.66.27.110", "101.35.217.145"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["121.127.33.186", "39.106.219.216", "114.66.27.110", "101.35.217.145"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Scenario: A DevOps team uses beacon or similar Cobalt Strike-derived tools for internal red teaming or penetration testing exercises, where the specific IOCs (e.g., specific mutex names, registry keys, or file paths) match the hunt package criteria.
- Filter/Exclusion: Exclude events where the source process path contains \pentest\ or \redteam\, or where the user account belongs to a dedicated “Red Team” security group.
Scenario: An IT administrator performs a scheduled maintenance task using a script that creates a temporary mutex or registry key with a name that coincidentally matches one of the 7 IOCs (e.g., a generic name like CS_BEACON used in a custom internal tool).
- Filter/Exclusion: Exclude events where the parent process is a known service executable (e.g., svchost.exe, wscript.exe, powershell.exe) and the action is a “Create” or “Set” on a registry key or mutex, provided the user account is in the “IT Admins” group and the time of day aligns with the maintenance window.
Scenario: A security engineer runs a YARA scan or memory dump analysis on a host, which may temporarily instantiate Cobalt Strike-related artifacts (like specific DLLs or memory signatures) as part of the detection tool’s own library or test cases.
- Filter/Exclusion: Exclude events where the source process is a known security tool (e.g., yara.exe, volatility.exe, falconctl.exe) or where the file path resides in a dedicated security tools directory (e.g., C:\Program Files\SecurityTools\).
Scenario: A software development team builds an application that embeds a Cobalt Strike beacon for testing purposes (e.g., a “test beacon” DLL