ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving the execution of Cobalt Strike tools by monitoring three specific indicators of compromise known to facilitate command and control operations. A proactive hunt is essential within Azure Sentinel because Cobalt Strike is a prevalent post-exploitation framework used by advanced threat actors to establish persistent access, making early identification critical for mitigating lateral movement risks.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["47.120.20.86", "43.139.87.203"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["47.120.20.86", "43.139.87.203"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Cobalt Strike

False Positive Guidance

• Scenario: The enterprise endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender) performs an automatic signature update that includes the beacon.exe binary hash associated with Cobalt Strike. Since the detection logic hunts for specific IOCs present in the environment, this legitimate update triggers a match on the host where the agent resides.

  • Filter/Exclusion: Create a rule exclusion based on the process name C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe (or equivalent agent path) and exclude any detection events originating from the specific file hash of the legitimate endpoint agent’s update service.

• Scenario: A scheduled PowerShell job runs nightly to audit network configurations, executing a script that invokes beacon.exe as part of a legacy inventory tool used by the IT Operations team. This scheduled task launches the executable with standard parameters, matching the Cobalt Strike IOC signature.

  • Filter/Exclusion: Add an exclusion for the specific Scheduled Task name (e.g., \Microsoft\Windows\Inventory\NightlyAudit) and filter out events where the parent process is svchost.exe or powershell.exe running under the context of a known service account like DOMAIN\IT-Service-Account.

• Scenario: The Security Operations Center (SOC) deploys a new threat hunting package using the Elastic Stack or Splunk, which includes a test run of the Cobalt Strike beacon binary within an isolated “Staging” environment to validate detection logic. This deployment generates alerts in the production monitoring window before being moved to production.

  • Filter/Exclusion: Implement a filter that excludes all hosts belonging to the STAGING-ENV OU (Organizational Unit) or IP subnet range (e.g., 10.50.x.x) for a 48-hour period following the deployment of new hunting packages, ensuring test