This hunt identifies hosts exhibiting network or file activity that matches known indicators of compromise associated with the Cobalt Strike framework, a prevalent post-exploitation tool used by adversaries for command and control. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to detect stealthy lateral movement or persistence mechanisms before they escalate into full-blown breaches, leveraging high-severity intelligence to reduce mean time to detection.
Malware Family: Cobalt Strike Total IOCs: 7 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 81[.]70[.]21[.]163:18080 | botnet_cc | 2026-09-23 | 100% |
| ip:port | 3[.]70[.]2[.]18:8080 | botnet_cc | 2026-09-23 | 100% |
| ip:port | 23[.]94[.]66[.]124:80 | botnet_cc | 2026-09-23 | 100% |
| ip:port | 3[.]70[.]2[.]18:80 | botnet_cc | 2026-09-23 | 100% |
| ip:port | 3[.]70[.]2[.]18:443 | botnet_cc | 2026-09-23 | 100% |
| ip:port | 23[.]94[.]66[.]124:22 | botnet_cc | 2026-09-23 | 100% |
| ip:port | 23[.]94[.]66[.]124:443 | botnet_cc | 2026-09-23 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["23.94.66.124", "3.70.2.18", "81.70.21.163"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["23.94.66.124", "3.70.2.18", "81.70.21.163"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Legitimate Internal Development and Testing: Developers or QA engineers frequently use Cobalt Strike in isolated lab environments or staging servers to test red teaming capabilities, vulnerability scanners, or custom tooling. Since these hosts often share network segments with production, their beaconing traffic or specific process hashes may match the IOCs.
env:staging or role:dev-lab from the detection logic, or create a specific allowlist for known development VLANs (e.g., 10.20.0.0/24) where Cobalt Strike is explicitly approved for testing.Third-Party Penetration Testing Engagement: During contracted security assessments, external red teamers deploy Cobalt Strike beacons on compromised or authorized assets to simulate persistent access. These sessions are temporary and often occur during off-hours, leading to transient IOC matches that are expected and documented in the engagement scope.
Internal Red Team / Purple Team Exercises: Internal security teams regularly conduct purple team exercises to validate detection coverage. These exercises intentionally trigger Cobalt Strike IOCs to test the SOC’s response. If the exercise is not properly flagged in the ticketing system or monitoring platform, the alerts are treated as new incidents.
Legacy or Embedded Tooling in Custom Scripts: Some enterprise custom automation scripts or legacy monitoring agents