This hunt detects adversary behavior involving the deployment of Cobalt Strike tools by identifying eight specific indicators of compromise known to facilitate command and control operations. A SOC team should proactively hunt for these signals in Azure Sentinel because early detection of this widely used post-exploitation framework allows for rapid containment before adversaries establish persistent access or pivot deeper into the network.
Malware Family: Cobalt Strike Total IOCs: 8 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 154[.]12[.]94[.]16:22 | botnet_cc | 2026-08-04 | 100% |
| ip:port | 182[.]92[.]83[.]146:8080 | botnet_cc | 2026-08-04 | 100% |
| ip:port | 206[.]238[.]42[.]153:4433 | botnet_cc | 2026-08-04 | 100% |
| ip:port | 106[.]75[.]249[.]202:8080 | botnet_cc | 2026-08-04 | 100% |
| ip:port | 106[.]75[.]249[.]202:443 | botnet_cc | 2026-08-04 | 100% |
| ip:port | 106[.]75[.]249[.]202:80 | botnet_cc | 2026-08-04 | 100% |
| ip:port | 124[.]222[.]145[.]172:7000 | botnet_cc | 2026-08-04 | 100% |
| ip:port | 198[.]199[.]72[.]177:9900 | botnet_cc | 2026-08-04 | 50% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["206.238.42.153", "182.92.83.146", "154.12.94.16", "106.75.249.202", "198.199.72.177", "124.222.145.172"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["206.238.42.153", "182.92.83.146", "154.12.94.16", "106.75.249.202", "198.199.72.177", "124.222.145.172"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: Legitimate IT administrators utilize Cobalt Strike within the Security Operations Center (SOC) or Red Team for authorized internal penetration testing and vulnerability assessments. When these teams execute their own “Beacon” clients against target systems, the detection logic triggers alerts based on the known IOCs (e.g., specific mutex names, registry keys, or network signatures).
Scenario: Enterprise-wide Microsoft Endpoint Configuration Manager (MECM/SCCM) or Intune scheduled tasks deploy software updates or run diagnostic scripts that utilize Cobalt Strike components as part of a third-party security suite integration. A nightly maintenance job might instantiate the Cobalt Strike beacon service to verify endpoint health, triggering the IOC detection logic during peak maintenance windows.
C:\Program Files\Microsoft Configuration Manager\inccom.exe or specific PowerShell scripts (powershell.exe) executing from a trusted administrative share.Scenario: The organization employs a third-party vulnerability scanner (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) that utilizes Cobalt Strike agents to perform active network discovery and asset inventory. When the scanner probes endpoints, it generates traffic patterns and file artifacts matching the 8 IOCs defined in the rule, causing false positives on non-critical