This hunt identifies the presence of known Cobalt Strike indicators of compromise, which adversaries frequently deploy to establish command-and-control channels and execute post-exploitation actions. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect stealthy intrusions early, reducing the dwell time of attackers who leverage this popular framework to maintain persistent access to cloud and hybrid environments.
Malware Family: Cobalt Strike Total IOCs: 18 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 36[.]255[.]97[.]162:22 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 36[.]255[.]97[.]162:27015 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 209[.]99[.]186[.]180:8080 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 36[.]133[.]104[.]91:10843 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 209[.]99[.]186[.]180:80 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 209[.]99[.]186[.]180:22 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 60[.]205[.]223[.]45:8081 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 60[.]205[.]223[.]45:8080 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 60[.]205[.]223[.]45:80 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 121[.]43[.]58[.]113:81 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 176[.]123[.]5[.]4:443 | botnet_cc | 2026-09-21 | 50% |
| ip:port | 47[.]94[.]76[.]119:8080 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 60[.]205[.]223[.]45:22 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 60[.]205[.]223[.]45:443 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 47[.]94[.]76[.]119:80 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 47[.]94[.]76[.]119:443 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 45[.]192[.]204[.]42:7000 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 47[.]94[.]76[.]119:3389 | botnet_cc | 2026-09-21 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["121.43.58.113", "209.99.186.180", "176.123.5.4", "60.205.223.45", "36.133.104.91", "45.192.204.42", "47.94.76.119", "36.255.97.162"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["121.43.58.113", "209.99.186.180", "176.123.5.4", "60.205.223.45", "36.133.104.91", "45.192.204.42", "47.94.76.119", "36.255.97.162"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: Scheduled Maintenance via beacon.exe Renamed to update.exe
\\fileserver\ops\tools\update.exe) and executes it. If the internal file share’s IP or the specific hash of the binary matches one of the 18 IOCs (e.g., a known Cobalt Strike beacon hash or a common C2 domain used in the hunt package), the rule triggers.powershell.exe or pwsh.exe AND the command line contains update.exe AND the source path is an internal file share (\\fileserver\). Alternatively, whitelist the specific SHA256 hash of the internal update.exe binary if it is stable.Scenario: Cobalt Strike Beacon Used for Internal Red Teaming/Testing
beacon.exe) on a test server to simulate an attacker. The beacon connects to an internal C2 server (e.g., 10.20.30.40:443) or uses a known Cobalt Strike default domain (e.g., cobaltstrike.com if not fully customized). The IOC match on the domain or process name triggers the alert.10.50.0.0/24) AND the process name is beacon.exe AND the user account belongs to the RedTeam security group.**Scenario: Legacy Application Using Cobalt Strike