This hunt detects adversary behavior involving the deployment of Cobalt Strike tools by matching network and host telemetry against a curated set of 17 specific Indicators of Compromise (IOCs). A SOC team should proactively hunt for this in Azure Sentinel to rapidly identify active command-and-control sessions or lateral movement attempts that may evade standard signature-based detections.
Malware Family: Cobalt Strike Total IOCs: 17 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 156[.]224[.]18[.]21:993 | botnet_cc | 2026-08-02 | 100% |
| ip:port | 156[.]224[.]18[.]21:465 | botnet_cc | 2026-08-02 | 100% |
| ip:port | 156[.]224[.]18[.]21:8020 | botnet_cc | 2026-08-02 | 100% |
| ip:port | 156[.]224[.]18[.]21:8000 | botnet_cc | 2026-08-02 | 100% |
| ip:port | 156[.]224[.]18[.]21:110 | botnet_cc | 2026-08-02 | 100% |
| ip:port | 124[.]222[.]145[.]172:3306 | botnet_cc | 2026-08-02 | 100% |
| ip:port | 111[.]170[.]148[.]141:81 | botnet_cc | 2026-08-02 | 100% |
| ip:port | 116[.]212[.]123[.]164:8443 | botnet_cc | 2026-08-02 | 100% |
| ip:port | 116[.]212[.]123[.]164:2095 | botnet_cc | 2026-08-02 | 100% |
| ip:port | 43[.]166[.]246[.]26:110 | botnet_cc | 2026-08-02 | 100% |
| ip:port | 117[.]72[.]125[.]206:11111 | botnet_cc | 2026-08-02 | 50% |
| ip:port | 103[.]41[.]19[.]111:111 | botnet_cc | 2026-08-02 | 100% |
| ip:port | 103[.]41[.]19[.]111:8082 | botnet_cc | 2026-08-02 | 100% |
| ip:port | 103[.]41[.]19[.]111:22 | botnet_cc | 2026-08-02 | 100% |
| ip:port | 103[.]41[.]19[.]111:80 | botnet_cc | 2026-08-02 | 100% |
| ip:port | 103[.]41[.]19[.]111:443 | botnet_cc | 2026-08-02 | 100% |
| ip:port | 156[.]224[.]18[.]21:8080 | botnet_cc | 2026-08-02 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["116.212.123.164", "124.222.145.172", "103.41.19.111", "43.166.246.26", "117.72.125.206", "156.224.18.21", "111.170.148.141"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["116.212.123.164", "124.222.145.172", "103.41.19.111", "43.166.246.26", "117.72.125.206", "156.224.18.21", "111.170.148.141"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: Automated patching workflows utilizing the Microsoft Endpoint Configuration Manager (SCCM) or Intune trigger network connections to known update servers that match the Cobalt Strike beacon IP ranges. These legitimate traffic flows often mimic the periodic “heartbeat” behavior of a Cobalt Strike beacon, causing the rule to flag routine software updates as potential command-and-control activity.
*.configmgr.microsoft.com, *.update.microsoft.com) or exclude traffic originating from the SCCCM site server subnet during standard maintenance windows.Scenario: Internal DevOps pipelines using Jenkins, GitLab CI/CD runners, or Azure DevOps agents execute scheduled build jobs that initiate outbound HTTPS connections to artifact repositories (e.g., Nexus, Artifactory) hosted on IP ranges overlapping with Cobalt Strike IOCs. The connection patterns of these long-running containerized agents can be misidentified as a persistent attacker beacon.
java.exe, node.exe, or specific CI/CD runner executables (e.g., gitlab-runner.exe) running within the designated DevOps subnet, provided the destination ports are restricted to standard repository ports (443, 8080).Scenario: Enterprise backup solutions such as Veeam Backup & Replication or Commvault run nightly scheduled jobs that establish persistent connections to cloud storage gateways or on-premise repositories. These backup agents often utilize IP addresses and connection intervals that align with the Cobalt Strike detection logic, generating false positives during peak backup windows (e.g., 02:00–04:00).