← Back to SOC feed Coverage →

ThreatFox: Cobalt Strike IOCs

ioc-hunt HIGH ThreatFox
CommonSecurityLogDeviceNetworkEvents
cobalt-strikeiocthreatfoxwin-cobalt_strike
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at ThreatFox →
Retrieved: 2026-07-28T11:00:01Z · Confidence: high

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of Cobalt Strike tools by matching network and host telemetry against a curated set of sixteen known indicators of compromise. The SOC team should proactively hunt for these signatures in Azure Sentinel to rapidly identify active post-exploitation frameworks that often serve as a precursor to lateral movement and data exfiltration within the enterprise environment.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 16 IOC Types: ip:port

TypeValueThreat TypeFirst SeenConfidence
ip:port168[.]144[.]45[.]2:8080botnet_cc2026-07-28100%
ip:port168[.]144[.]45[.]2:443botnet_cc2026-07-28100%
ip:port168[.]144[.]45[.]2:80botnet_cc2026-07-28100%
ip:port106[.]14[.]243[.]66:5555botnet_cc2026-07-28100%
ip:port123[.]57[.]243[.]182:80botnet_cc2026-07-28100%
ip:port8[.]135[.]47[.]140:80botnet_cc2026-07-28100%
ip:port8[.]135[.]47[.]140:8080botnet_cc2026-07-28100%
ip:port49[.]7[.]215[.]149:443botnet_cc2026-07-28100%
ip:port49[.]7[.]215[.]149:111botnet_cc2026-07-28100%
ip:port49[.]7[.]215[.]149:8080botnet_cc2026-07-28100%
ip:port49[.]7[.]215[.]149:22botnet_cc2026-07-28100%
ip:port49[.]7[.]215[.]149:80botnet_cc2026-07-28100%
ip:port45[.]87[.]53[.]6:8890botnet_cc2026-07-28100%
ip:port49[.]7[.]215[.]149:3389botnet_cc2026-07-28100%
ip:port47[.]238[.]100[.]128:22botnet_cc2026-07-28100%
ip:port158[.]94[.]211[.]163:24443botnet_cc2026-07-2775%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["47.238.100.128", "158.94.211.163", "168.144.45.2", "45.87.53.6", "8.135.47.140", "106.14.243.66", "49.7.215.149", "123.57.243.182"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["47.238.100.128", "158.94.211.163", "168.144.45.2", "45.87.53.6", "8.135.47.140", "106.14.243.66", "49.7.215.149", "123.57.243.182"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DeviceNetworkEventsEnsure this data connector is enabled

References

False Positive Guidance

Original source: https://threatfox.abuse.ch/browse/malware/win.cobalt_strike/