ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of Cobalt Strike tools by identifying five specific indicators of compromise (IOCs) that signal potential command and control or lateral movement activities. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly identify and contain early-stage intrusions, as Cobalt Strike is a widely used beacon framework often leveraged by threat actors during the post-exploitation phase.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`119[.]45[.]239[.]141:5555`	botnet_cc	2026-08-10	100%
ip:port	`49[.]235[.]110[.]173:443`	botnet_cc	2026-08-10	100%
ip:port	`117[.]24[.]4[.]112:5555`	botnet_cc	2026-08-10	100%
ip:port	`130[.]94[.]14[.]110:443`	botnet_cc	2026-08-10	50%
ip:port	`206[.]237[.]12[.]167:10443`	botnet_cc	2026-08-10	50%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["49.235.110.173", "130.94.14.110", "119.45.239.141", "206.237.12.167", "117.24.4.112"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["49.235.110.173", "130.94.14.110", "119.45.239.141", "206.237.12.167", "117.24.4.112"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule, along with recommended filters and exclusions tailored for an enterprise environment:

Scenario: Legitimate Endpoint Management Scans
- Context: Enterprise EDR agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) or network scanning tools (e.g., Tenable Nessus, Qualys) frequently utilize the same ports and executable names as Cobalt Strike’s Beacon. For instance, a scheduled vulnerability scan might spawn beacon.exe from a trusted management server to query asset inventory, triggering the IOC match for “Cobalt Strike Beacon Process.”
- Filter/Exclusion: Create an exclusion rule that suppresses alerts where the process path matches known EDR installation directories (e.g., C:\Program Files\CrowdStrike\... or C:\Windows\System32\...) and the parent process is a recognized management service (e.g., svchost.exe, falcon.sys). Additionally, exclude traffic originating from specific internal IP ranges dedicated to patching and asset discovery.
Scenario: Scheduled Administrative Maintenance Jobs
- Context: IT Operations teams often deploy custom PowerShell scripts or batch files for nightly maintenance (e.g., log rotation, disk cleanup) that are named beacon.exe or utilize the same registry keys monitored by the rule. These jobs may be triggered via Task Scheduler to run under a local system account, mimicking the behavior of a Cobalt Strike beacon establishing persistence.
- Filter/Exclusion: Implement a filter based on the “Parent Process Name” and “Scheduled Job ID.” Exclude alerts where the parent process is TaskScheduler.exe or powershell.exe running from a known administrative share (e.g., \\FileServer\Scripts\AdminJobs). Specifically, whitelist the hash of these