The detection identifies potential Cobalt Strike command and control activity through known IOCs, indicating an adversary may be establishing persistence and exfiltrating data. SOC teams should proactively hunt for this behavior to detect and mitigate advanced persistent threats leveraging Cobalt Strike in their Azure Sentinel environment.
IOC Summary
Malware Family: Cobalt Strike Total IOCs: 21 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 45[.]67[.]39[.]175:995 | botnet_cc | 2026-06-14 | 100% |
| ip:port | 194[.]38[.]104[.]204:443 | botnet_cc | 2026-06-14 | 98% |
| ip:port | 185[.]190[.]157[.]173:443 | botnet_cc | 2026-06-14 | 98% |
| ip:port | 185[.]220[.]60[.]185:443 | botnet_cc | 2026-06-14 | 98% |
| ip:port | 185[.]193[.]88[.]139:8443 | botnet_cc | 2026-06-14 | 100% |
| ip:port | 194[.]58[.]98[.]20:443 | botnet_cc | 2026-06-14 | 100% |
| ip:port | 65[.]87[.]7[.]18:80 | botnet_cc | 2026-06-14 | 100% |
| ip:port | 8[.]152[.]2[.]86:9999 | botnet_cc | 2026-06-14 | 100% |
| ip:port | 103[.]47[.]83[.]115:80 | botnet_cc | 2026-06-14 | 100% |
| ip:port | 188[.]227[.]14[.]105:80 | botnet_cc | 2026-06-14 | 100% |
| ip:port | 65[.]21[.]202[.]12:80 | botnet_cc | 2026-06-14 | 100% |
| ip:port | 165[.]154[.]254[.]203:80 | botnet_cc | 2026-06-14 | 100% |
| ip:port | 165[.]154[.]254[.]203:443 | botnet_cc | 2026-06-14 | 100% |
| ip:port | 49[.]232[.]4[.]71:81 | botnet_cc | 2026-06-14 | 100% |
| ip:port | 49[.]232[.]4[.]71:8080 | botnet_cc | 2026-06-14 | 100% |
| ip:port | 49[.]232[.]4[.]71:443 | botnet_cc | 2026-06-14 | 100% |
| ip:port | 49[.]232[.]4[.]71:80 | botnet_cc | 2026-06-14 | 100% |
| ip:port | 43[.]99[.]110[.]114:8081 | botnet_cc | 2026-06-14 | 100% |
| ip:port | 120[.]27[.]245[.]127:8080 | botnet_cc | 2026-06-13 | 100% |
| ip:port | 120[.]27[.]245[.]127:443 | botnet_cc | 2026-06-13 | 100% |
| ip:port | 120[.]27[.]245[.]127:80 | botnet_cc | 2026-06-13 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["65.21.202.12", "103.47.83.115", "185.193.88.139", "188.227.14.105", "185.190.157.173", "185.220.60.185", "65.87.7.18", "165.154.254.203", "43.99.110.114", "49.232.4.71", "120.27.245.127", "45.67.39.175", "194.58.98.20", "194.38.104.204", "8.152.2.86"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["65.21.202.12", "103.47.83.115", "185.193.88.139", "188.227.14.105", "185.190.157.173", "185.220.60.185", "65.87.7.18", "165.154.254.203", "43.99.110.114", "49.232.4.71", "120.27.245.127", "45.67.39.175", "194.58.98.20", "194.38.104.204", "8.152.2.86"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: Scheduled Cobalt Strike Beacon Check-in
Description: A legitimate scheduled job runs a Cobalt Strike Beacon to verify connectivity or check for updates.
Filter/Exclusion: process.name != "beacon.exe" OR process.parent.name != "task scheduler"
Scenario: Admin Task to Generate Cobalt Strike Test Payload
Description: An administrator uses Cobalt Strike to generate a test payload for internal security testing.
Filter/Exclusion: process.user != "admin_account" OR process.command_line contains "test_payload"
Scenario: Cobalt Strike Used for Red Team Engagement
Description: A red team exercise uses Cobalt Strike to simulate an attack and test defenses.
Filter/Exclusion: process.user contains "redteam" OR process.command_line contains "redteam"
Scenario: Cobalt Strike Beacon Used for Internal Monitoring
Description: A security team deploys a Cobalt Strike Beacon to monitor internal network traffic for anomalies.
Filter/Exclusion: process.user contains "security_team" OR process.command_line contains "monitor"
Scenario: Cobalt Strike Used for Post-Exploitation Debugging
Description: A security analyst uses Cobalt Strike to debug a compromised system or analyze malware behavior.
Filter/Exclusion: process.user contains "analyst" OR process.command_line contains "debug"