ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of Cobalt Strike beacons, which are frequently utilized by threat actors to establish persistent command and control channels within compromised networks. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early identification of Cobalt Strike artifacts allows the SOC team to rapidly isolate affected endpoints before attackers can expand their lateral movement or exfiltrate sensitive data.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["51.222.87.16", "1.116.121.47"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["51.222.87.16", "1.116.121.47"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Cobalt Strike

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Cobalt Strike IOCs detection rule in an enterprise environment:

• Scenario: DevOps CI/CD Pipeline Execution

  • Context: Automated build agents (e.g., Jenkins, GitLab Runner) or container orchestration tools (Kubernetes) often utilize beacon.exe or similar C2 framework binaries during the testing phase of a deployment pipeline. These agents may spin up temporary containers that match the Cobalt Strike hash signatures while running integration tests.
  • Filter/Exclusion: Exclude processes where the parent process is a known CI/CD orchestrator (e.g., java.exe for Jenkins, gitlab-runner.exe, or kubelet) and the execution path resides within a dedicated build directory (e.g., C:\Jenkins\workspace\* or /var/lib/gitlab-runner/\*).

• Scenario: Scheduled Endpoint Security Scans

  • Context: Enterprise EDR solutions (such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black) frequently include Cobalt Strike signatures in their heuristic engine. During scheduled deep scans or real-time monitoring updates, the security agent itself may spawn a helper process that mimics the IOCs of Cobalt Strike to verify threat detection capabilities.
  • Filter/Exclusion: Create an exclusion rule for processes running under specific service accounts (e.g., NT SERVICE\CrowdStrikeService, SYSTEM) where the command line contains keywords like “scan,” “update,” or “heuristic” and the file path is within the vendor’s installation directory (e.g., C:\Program Files\CrowdStrike\*\*).

• Scenario: IT Admin Remote Management Sessions

  • Context: System administrators often use remote management tools (like SCCM, PDQ Deploy, or custom PowerShell