ThreatFox: Cobalt Strike IOCs

Hunt Hypothesis

This hunt targets the presence of known Cobalt Strike indicators of compromise, which adversaries frequently deploy to establish persistent command-and-control channels and execute post-exploitation tasks. Proactively hunting for these IOCs in Azure Sentinel is critical because Cobalt Strike is a widely abused framework that often operates stealthily, allowing attackers to maintain access and pivot laterally before traditional detections trigger.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 30 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`8[.]160[.]168[.]147:80`	botnet_cc	2026-09-18	100%
ip:port	`8[.]160[.]168[.]147:8080`	botnet_cc	2026-09-18	100%
ip:port	`8[.]160[.]168[.]147:443`	botnet_cc	2026-09-18	100%
ip:port	`8[.]160[.]168[.]147:22`	botnet_cc	2026-09-18	100%
ip:port	`60[.]204[.]248[.]97:80`	botnet_cc	2026-09-18	100%
ip:port	`60[.]204[.]248[.]97:443`	botnet_cc	2026-09-18	100%
ip:port	`60[.]204[.]248[.]97:8080`	botnet_cc	2026-09-18	100%
ip:port	`60[.]204[.]248[.]97:22`	botnet_cc	2026-09-18	100%
ip:port	`49[.]232[.]21[.]222:3000`	botnet_cc	2026-09-18	100%
ip:port	`45[.]207[.]219[.]134:888`	botnet_cc	2026-09-18	100%
ip:port	`45[.]207[.]219[.]134:3306`	botnet_cc	2026-09-18	100%
ip:port	`45[.]207[.]219[.]134:22`	botnet_cc	2026-09-18	100%
ip:port	`106[.]54[.]201[.]103:9999`	botnet_cc	2026-09-18	100%
ip:port	`81[.]70[.]21[.]163:80`	botnet_cc	2026-09-18	100%
ip:port	`112[.]126[.]27[.]96:80`	botnet_cc	2026-09-18	100%
ip:port	`45[.]207[.]219[.]134:8080`	botnet_cc	2026-09-18	100%
ip:port	`47[.]99[.]109[.]10:8080`	botnet_cc	2026-09-18	100%
ip:port	`81[.]70[.]21[.]163:8000`	botnet_cc	2026-09-18	100%
ip:port	`45[.]207[.]219[.]134:80`	botnet_cc	2026-09-18	100%
ip:port	`45[.]207[.]219[.]134:443`	botnet_cc	2026-09-18	100%
ip:port	`43[.]226[.]39[.]138:80`	botnet_cc	2026-09-18	100%
ip:port	`43[.]226[.]39[.]138:8080`	botnet_cc	2026-09-18	100%
ip:port	`45[.]207[.]219[.]134:21`	botnet_cc	2026-09-18	100%
ip:port	`43[.]226[.]39[.]138:443`	botnet_cc	2026-09-18	100%
ip:port	`117[.]72[.]202[.]154:22`	botnet_cc	2026-09-18	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["60.204.248.97", "45.207.219.134", "106.54.201.103", "112.126.27.96", "117.72.202.154", "187.52.119.59", "43.226.39.138", "8.160.168.147", "81.70.21.163", "49.232.21.222", "47.99.109.10"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["60.204.248.97", "45.207.219.134", "106.54.201.103", "112.126.27.96", "117.72.202.154", "187.52.119.59", "43.226.39.138", "8.160.168.147", "81.70.21.163", "49.232.21.222", "47.99.109.10"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Cobalt Strike

False Positive Guidance

Legitimate Internal Red Team or Penetration Test: During authorized security assessments, internal red teams or contracted pentesters often use Cobalt Strike to simulate adversary behavior. This triggers the IOC hunt as expected.
- Filter/Exclusion: Exclude source IPs or hostnames associated with the Red Team/Pentest VLAN or specific service accounts (e.g., svc-redteam, pentest-admin) during the active engagement window.
Software Development and Testing Environments: Developers and QA engineers may use Cobalt Strike in isolated lab environments or CI/CD pipelines to test application resilience, security controls, or to validate detection logic before production deployment.
- Filter/Exclusion: Exclude hosts tagged with env=dev, env=qa, or lab, or exclude specific subnets designated for development and testing (e.g., 10.20.0.0/24).
Third-Party Security Tooling or EDR Agents: Some advanced EDR platforms or threat emulation tools (like Breach and Attack Simulation [BAS] tools such as SafeBreach or AttackIQ) may use Cobalt Strike binaries or IOCs internally to simulate attacks for testing purposes.
- Filter/Exclusion: Exclude processes or hosts where the parent process is a known BAS/EDR agent (e.g., AttackIQ.exe, SafeBreachAgent.exe) or exclude specific service accounts used by these tools (e.g., svc-bas, edr-agent).
Legacy or Custom Internal Tools: In some enterprises, custom-built internal tools or legacy applications may inadvertently embed Cobalt Strike components or use similar IOCs (e.g., specific beacon intervals, known file hashes) for internal communication or monitoring.
- Filter/Exclusion: Identify and whitelist specific file paths or hashes used by these internal tools (e.g., `C:\