This hunt targets the presence of known Cobalt Strike indicators of compromise, which adversaries frequently deploy to establish persistent command-and-control channels and execute post-exploitation actions. Proactively hunting for these IOCs in Azure Sentinel is critical because Cobalt Strike is a prevalent tool in advanced intrusions, allowing the SOC to identify compromised assets before lateral movement or data exfiltration occurs.
Malware Family: Cobalt Strike Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 13[.]140[.]59[.]149:443 | botnet_cc | 2026-09-26 | 100% |
| ip:port | 46[.]250[.]228[.]119:1337 | botnet_cc | 2026-09-26 | 100% |
| ip:port | 209[.]38[.]82[.]85:8443 | botnet_cc | 2026-09-26 | 100% |
| ip:port | 47[.]114[.]83[.]19:22 | botnet_cc | 2026-09-26 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["47.114.83.19", "209.38.82.85", "13.140.59.149", "46.250.228.119"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["47.114.83.19", "209.38.82.85", "13.140.59.149", "46.250.228.119"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps team deploys a custom internal build agent or CI/CD runner (e.g., Jenkins, GitLab Runner) that uses a generic powershell.exe or cmd.exe process to execute deployment scripts, where the parent-child relationship or specific memory patterns match one of the Cobalt Strike IOCs (such as a specific hash or process name like beacon.exe if the internal tool is misnamed).
jenkins.exe, gitlab-runner.exe) or exclude paths under C:\ProgramData\Jenkins\ or C:\GitLab\.Scenario: An IT administrator runs a standard Windows scheduled task using schtasks.exe to execute a PowerShell script for disk cleanup or log rotation, where the script is saved in a temporary directory or executed via a command line that triggers a heuristic IOC (e.g., specific base64 encoded strings or process injection patterns).
schtasks.exe or powershell.exe with arguments matching known admin scripts (e.g., -File C:\AdminScripts\cleanup.ps1) and the user account belongs to the IT_Admins security group.Scenario: A software vendor’s updater or installer (e.g., Adobe Creative Cloud, Zoom, or a custom internal application) uses a helper process named update.exe or helper.exe that resides in a user-writable directory like %TEMP% or %APPDATA%, triggering an IOC based on process location or name.
C:\Program Files\Adobe\, `C:\Users*\AppData\Local\