This detection rule identifies adversary activity involving known Cobalt Strike indicators of compromise, which are frequently utilized by threat actors to establish command and control channels during post-exploitation phases. Proactively hunting for these IOCs within Azure Sentinel is critical because Cobalt Strike remains a ubiquitous tool in advanced persistent threats, allowing the SOC team to rapidly detect and contain active lateral movements before they escalate into broader network compromises.
Malware Family: Cobalt Strike Total IOCs: 21 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 102[.]204[.]223[.]230:8080 | botnet_cc | 2026-08-05 | 100% |
| ip:port | 102[.]204[.]223[.]230:80 | botnet_cc | 2026-08-05 | 100% |
| ip:port | 43[.]108[.]51[.]124:10001 | botnet_cc | 2026-08-05 | 100% |
| ip:port | 102[.]204[.]223[.]230:443 | botnet_cc | 2026-08-05 | 100% |
| ip:port | 36[.]140[.]162[.]173:8001 | botnet_cc | 2026-08-05 | 100% |
| ip:port | 36[.]140[.]162[.]173:20443 | botnet_cc | 2026-08-05 | 100% |
| ip:port | 36[.]140[.]162[.]173:22 | botnet_cc | 2026-08-05 | 100% |
| ip:port | 36[.]140[.]162[.]173:111 | botnet_cc | 2026-08-05 | 100% |
| ip:port | 169[.]58[.]82[.]229:8083 | botnet_cc | 2026-08-05 | 100% |
| ip:port | 169[.]58[.]82[.]229:9090 | botnet_cc | 2026-08-05 | 100% |
| ip:port | 169[.]58[.]82[.]229:8080 | botnet_cc | 2026-08-05 | 100% |
| ip:port | 169[.]58[.]82[.]229:80 | botnet_cc | 2026-08-05 | 100% |
| ip:port | 207[.]57[.]134[.]202:443 | botnet_cc | 2026-08-05 | 100% |
| ip:port | 102[.]204[.]223[.]230:5555 | botnet_cc | 2026-08-05 | 100% |
| ip:port | 169[.]58[.]82[.]229:22 | botnet_cc | 2026-08-05 | 100% |
| ip:port | 43[.]163[.]88[.]35:80 | botnet_cc | 2026-08-05 | 50% |
| ip:port | 43[.]108[.]51[.]124:8080 | botnet_cc | 2026-08-05 | 100% |
| ip:port | 43[.]108[.]51[.]124:7000 | botnet_cc | 2026-08-05 | 100% |
| ip:port | 43[.]108[.]51[.]124:22155 | botnet_cc | 2026-08-05 | 100% |
| ip:port | 43[.]108[.]51[.]124:80 | botnet_cc | 2026-08-05 | 100% |
| ip:port | 43[.]108[.]51[.]124:443 | botnet_cc | 2026-08-05 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["169.58.82.229", "102.204.223.230", "207.57.134.202", "43.163.88.35", "43.108.51.124", "36.140.162.173"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["169.58.82.229", "102.204.223.230", "207.57.134.202", "43.163.88.35", "43.108.51.124", "36.140.162.173"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: Scheduled automated backups or patch management workflows utilizing the Cobalt Strike beacon executable name (beacon.exe) within a trusted directory structure. For instance, an enterprise using Microsoft SCCM (System Center Configuration Manager) or Jenkins CI/CD pipelines may deploy a custom utility named beacon.exe to monitor deployment status, which matches the rule’s filename IOC.
C:\Program Files\Microsoft Configuration Manager\, C:\Jenkins\) and the parent process is a known system service like ccmexec.exe or java.exe.Scenario: Legitimate IT administrators performing remote troubleshooting sessions using Cobalt Strike as an authorized security tool. When a Security Operations Center (SOC) analyst or a privileged admin runs the Cobalt Strike client (cobaltstrike.exe) or launches the beacon from their workstation to conduct a penetration test or asset inventory, it triggers the IOC match.
User Account attribute, specifically whitelisting accounts within the “Security-Admins” or “Penetration-Testing” Active Directory groups when the process originates from known management jump hosts (e.g., specific IP ranges like 10.20.30.x).Scenario: Third-party security solutions or endpoint detection and response (EDR) tools that bundle Cobalt Strike components for their own telemetry collection. For example, a deployment of CrowdStrike Falcon or SentinelOne might utilize a background service named beacon.exe to relay logs to the central console, mimicking the signature of the threat tool.