This rule detects the presence of known Cobalt Strike indicators, which adversaries frequently deploy to establish command-and-control channels and execute post-exploitation activities. Proactively hunting for these IOCs allows the SOC to identify active or dormant implants early, reducing the dwell time of a high-severity threat before it can escalate privileges or exfiltrate data.
Malware Family: Cobalt Strike Total IOCs: 26 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 47[.]97[.]199[.]23:8080 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 47[.]97[.]199[.]23:443 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 145[.]79[.]143[.]4:8080 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 123[.]57[.]146[.]34:22 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 145[.]79[.]143[.]4:22 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 145[.]79[.]143[.]4:443 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 116[.]62[.]174[.]16:82 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 1[.]12[.]59[.]176:81 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 47[.]114[.]83[.]19:81 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 145[.]79[.]143[.]4:80 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 47[.]97[.]199[.]23:80 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 111[.]230[.]37[.]219:8123 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 111[.]230[.]37[.]219:9004 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 111[.]230[.]37[.]219:80 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 111[.]230[.]37[.]219:8080 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 111[.]230[.]37[.]219:443 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 111[.]230[.]37[.]219:22 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 121[.]43[.]58[.]113:80 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 121[.]43[.]58[.]113:8080 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 121[.]43[.]58[.]113:443 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 149[.]88[.]73[.]83:8080 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 149[.]88[.]73[.]83:8000 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 149[.]88[.]73[.]83:80 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 149[.]88[.]73[.]83:443 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 149[.]88[.]73[.]83:22 | botnet_cc | 2026-09-22 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["47.114.83.19", "123.57.146.34", "111.230.37.219", "78.17.212.127", "145.79.143.4", "121.43.58.113", "47.97.199.23", "116.62.174.16", "149.88.73.83", "1.12.59.176"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["47.114.83.19", "123.57.146.34", "111.230.37.219", "78.17.212.127", "145.79.143.4", "121.43.58.113", "47.97.199.23", "116.62.174.16", "149.88.73.83", "1.12.59.176"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses a custom internal wrapper script that embeds Cobalt Strike beacon signatures (e.g., specific beacon.dll hashes or known default sleep obfuscation patterns) to automate deployment verification tasks on staging servers.
powershell.exe or pwsh.exe and the command line contains the internal wrapper script name (e.g., deploy_verify.ps1), or exclude hosts tagged with the Staging-Environment resource tag.Scenario: An IT administrator performs a scheduled maintenance task using a third-party patch management tool (e.g., SCCM or Ansible) that temporarily loads a Cobalt Strike-based agent for remote execution testing on a small subset of test VMs.
IT-Management-Servers subnet (e.g., 10.20.0.0/24) and the destination host is in the Test-VMs AD group, or exclude if the process name is ansible-playbook.exe or ccmsetup.exe.Scenario: A security team runs a periodic red team exercise or purple team simulation where Cobalt Strike beacons are intentionally deployed on non-production assets to validate detection coverage.
RedTeam-Exercise=true set in their CMDB/Intune profile.Scenario: A legacy application server uses a custom-built .NET assembly that statically links a Cobalt Strike beacon library for inter-process communication, resulting in the IOC hash matching the loaded module.