HuntSQL Recipes Help Analysts Find and Track Cobalt Strike Infrastructure

Nov 19, 2025 · Original article ↗

Summary

The guide presents HuntSQL queries for detecting and clustering Cobalt Strike infrastructure using fingerprints such as watermarks, public keys, beacon behavior, URIs, and hosting data.

Key points

Queries use Cobalt Strike watermarks and public keys to group related beacon sightings and infrastructure.
URI patterns, user-agent strings, ports, and TLS-related traits can help identify beacons masquerading as normal web traffic.
Beacon timing and process-spawn fields offer behavioral pivots for hunting in network and endpoint telemetry.
The guide demonstrates a profile-based hunt associated with Lazarus tradecraft and identifies a matching IP as an investigative lead.
The authors recommend combining multiple indicators and validating findings to reduce false confidence.

Article Details

Defense Focus: Detect, cluster, and investigate Cobalt Strike command-and-control infrastructure using beacon fingerprints and related network and endpoint behavior.
Detection Methods: Query and correlate Cobalt Strike watermark and public-key values to cluster beacon configurations and related infrastructure.
Filter recent observations by watermark and pivot across IP address, port, URI, hostname, and timestamp.
Hunt for browser-like user agents combined with WordPress-style submit URIs or Microsoft-CryptoAPI/6.1 with an OSCP-style URI.
Search submit URIs for action verbs such as login, post, and submit, and correlate the paths with domains and ports.
Identify beaconing patterns using sleeptime and jitter, including unusually short callback intervals.
Correlate spawn targets and process-injection fields with endpoint process activity, including dllhost.exe.
Group observations by ASN and country to identify hosting clusters and recurring infrastructure.
Data Sources: Hunt.io Malware Dataset, including scanner-observed infrastructure, scan timestamps, provenance, and confidence.
Network-flow, firewall, and proxy telemetry.
EDR and process-creation telemetry.
Web server logs, passive DNS, domain history, and TLS certificate observations.
Rule Types: HuntSQL SQL-like filtering, aggregation, grouping, and sorting queries.
HuntSQL LIKE and RLIKE pattern filters for URI and user-agent matching.
Behavioral threshold queries for beacon sleeptime and jitter.
Platforms: Hunt.io Malware Dataset
EDR platforms
Defensive Actions: Start with broad dataset distributions, then narrow hunts using watermark and public-key fingerprints.
Validate and enrich infrastructure leads before escalating or attributing activity.
Pivot between IPs, ports, domains, URI paths, scan timestamps, and certificate reuse to investigate related servers.
Check proxy, firewall, and network-flow records for unusual beacon traffic, including on common web ports and nonstandard ports.
Search endpoint process-creation and EDR telemetry for unusual dllhost.exe parentage or injected memory regions.
Use recurring ASN activity to prioritize infrastructure investigation and consider cloud-abuse reporting or threat-intelligence sharing.

Indicators of compromise

Type	Indicator	Context
IPV4	`124[.]223[.]25[.]186`	Reported as a high-risk server with active Cobalt Strike activity and multiple beacon endpoints.
IPV4	`147[.]185[.]221[.]25`	Example IP associated with a Cobalt Strike beacon configured with an extremely short callback interval.
IPV4	`185[.]196[.]11[.]20`	Example IP associated with a Cobalt Strike beacon configured with an extremely short callback interval.
IPV4	`93[.]113[.]25[.]195`	Reported as a high-risk host with active Cobalt Strike activity matching a profile linked to APT Lazarus.