This hunt targets the presence of known Cobalt Strike indicators of compromise, which adversaries frequently deploy to establish command-and-control channels and execute post-exploitation actions. Proactively hunting for these high-severity IOCs in Azure Sentinel allows the SOC to identify active or dormant implantations before they progress to lateral movement or data exfiltration.
Malware Family: Cobalt Strike Total IOCs: 24 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 47[.]116[.]130[.]234:22 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 47[.]116[.]130[.]234:8088 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 47[.]116[.]130[.]234:8080 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 45[.]145[.]228[.]161:9999 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 47[.]116[.]130[.]234:82 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 116[.]62[.]174[.]16:81 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 130[.]94[.]66[.]86:80 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 47[.]116[.]130[.]234:80 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 47[.]116[.]130[.]234:443 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 36[.]255[.]97[.]162:80 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 36[.]255[.]97[.]162:8080 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 124[.]223[.]177[.]82:80 | botnet_cc | 2026-09-20 | 50% |
| ip:port | 36[.]255[.]97[.]162:443 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 49[.]232[.]21[.]222:888 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 81[.]70[.]21[.]163:8080 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 81[.]70[.]21[.]163:443 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 81[.]70[.]21[.]163:8091 | botnet_cc | 2026-09-20 | 75% |
| ip:port | 106[.]54[.]201[.]103:80 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 106[.]54[.]201[.]103:8080 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 43[.]136[.]93[.]107:80 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 106[.]54[.]201[.]103:443 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 43[.]136[.]93[.]107:443 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 49[.]232[.]21[.]222:88 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 101[.]43[.]31[.]60:123 | botnet_cc | 2026-09-19 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["81.70.21.163", "101.43.31.60", "36.255.97.162", "130.94.66.86", "106.54.201.103", "45.145.228.161", "116.62.174.16", "43.136.93.107", "124.223.177.82", "47.116.130.234", "49.232.21.222"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["81.70.21.163", "101.43.31.60", "36.255.97.162", "130.94.66.86", "106.54.201.103", "45.145.228.161", "116.62.174.16", "43.136.93.107", "124.223.177.82", "47.116.130.234", "49.232.21.222"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses a custom PowerShell script to deploy a lightweight monitoring agent (e.g., a modified version of Beacon or a similar C2 framework) for internal network testing, where the script hashes match a known Cobalt Strike IOCs due to shared code structures or default configurations.
powershell.exe or pwsh.exe and the command line contains specific deployment keywords (e.g., -Deploy, -Install, or -TestMode) and the user account belongs to the DevOps-Admins security group.Scenario: An IT administrator runs a scheduled task using Task Scheduler to execute a maintenance script that temporarily downloads and runs a diagnostic tool from a trusted internal repository, where the tool’s binary hash coincidentally matches one of the 24 IOCs because it was built from a common open-source template used in Cobalt Strike.
schtasks.exe or Task Scheduler and the working directory is under a known administrative path (e.g., C:\Admin\Tools\ or C:\Scripts\Maintenance\), and the user account is in the Local Administrators group.Scenario: A security team performs a red team exercise or internal penetration test using a legitimate Cobalt Strike beacon to validate detection coverage, but the test is not tagged with a unique identifier, causing the IOCs to trigger as if they were a live threat.
-Tag=RedTeam2024 or #PenTest) or where the user account is a dedicated service account (e.g., svc_redteam) that is not used for