This hypothesis targets the presence of known Cobalt Strike indicators, a prevalent post-exploitation framework used by adversaries to establish command-and-control channels and execute lateral movement. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised assets before attackers fully establish persistence or escalate privileges, reducing the mean time to detection for high-severity threats.
Malware Family: Cobalt Strike Total IOCs: 19 IOC Types: domain, ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 49[.]233[.]181[.]236:8082 | botnet_cc | 2026-09-25 | 100% |
| ip:port | 49[.]233[.]181[.]236:8080 | botnet_cc | 2026-09-25 | 100% |
| ip:port | 49[.]233[.]181[.]236:443 | botnet_cc | 2026-09-25 | 100% |
| ip:port | 49[.]233[.]181[.]236:80 | botnet_cc | 2026-09-25 | 100% |
| ip:port | 49[.]233[.]181[.]236:4567 | botnet_cc | 2026-09-25 | 100% |
| ip:port | 191[.]124[.]5[.]229:8443 | botnet_cc | 2026-09-25 | 100% |
| ip:port | 47[.]109[.]48[.]152:443 | botnet_cc | 2026-09-25 | 100% |
| ip:port | 210[.]16[.]168[.]11:9999 | botnet_cc | 2026-09-25 | 100% |
| ip:port | 1[.]12[.]59[.]176:8006 | botnet_cc | 2026-09-25 | 100% |
| ip:port | 156[.]254[.]20[.]48:888 | botnet_cc | 2026-09-25 | 100% |
| ip:port | 156[.]254[.]20[.]48:3622 | botnet_cc | 2026-09-25 | 100% |
| ip:port | 23[.]27[.]143[.]19:22 | botnet_cc | 2026-09-25 | 100% |
| ip:port | 47[.]94[.]56[.]71:8443 | botnet_cc | 2026-09-25 | 50% |
| ip:port | 42[.]51[.]44[.]173:18888 | botnet_cc | 2026-09-25 | 75% |
| ip:port | 45[.]227[.]253[.]132:56225 | botnet_cc | 2026-09-25 | 75% |
| ip:port | 43[.]136[.]69[.]37:443 | botnet_cc | 2026-09-25 | 75% |
| ip:port | 42[.]51[.]44[.]173:18443 | botnet_cc | 2026-09-25 | 75% |
| ip:port | 139[.]196[.]50[.]117:8839 | botnet_cc | 2026-09-25 | 75% |
| domain | i.gckni.com | botnet_cc | 2026-09-25 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["1.12.59.176", "47.109.48.152", "23.27.143.19", "43.136.69.37", "139.196.50.117", "191.124.5.229", "156.254.20.48", "45.227.253.132", "49.233.181.236", "210.16.168.11", "42.51.44.173", "47.94.56.71"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["1.12.59.176", "47.109.48.152", "23.27.143.19", "43.136.69.37", "139.196.50.117", "191.124.5.229", "156.254.20.48", "45.227.253.132", "49.233.181.236", "210.16.168.11", "42.51.44.173", "47.94.56.71"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Cobalt Strike
let malicious_domains = dynamic(["i.gckni.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
VirtualAlloc with specific size/flags or a known Cobalt Strike beacon hash).
powershell.exe or pwsh.exe and the parent process is a known CI/CD agent (e.g., jenkins.exe, gitlab-runner, azure-pipelines-agent) or a service account running under a specific OU (e.g., OU=DevOps,DC=corp,DC=local).nmap or a custom Python script) that performs a TCP connection to a port commonly used by Cobalt Strike (e.g., 443, 80, or 8080) with a specific User-Agent string or TLS fingerprint that matches an IOC.
10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the source process is a known diagnostic tool (e.g., nmap.exe, python.exe, curl.exe) or belongs to the Service Accounts group.volatility or pe-sieve) on a host to identify potential implants, which may load a Cobalt Strike beacon into memory for testing or detection validation, triggering the IOC.