This hunt targets known Cobalt Strike indicators of compromise to identify active adversary post-exploitation activities, such as command-and-control beaconing or lateral movement, within the environment. Proactively hunting for these high-severity IOCs in Azure Sentinel allows the SOC to detect and isolate compromised assets before attackers can establish persistent footholds or escalate privileges.
Malware Family: Cobalt Strike Total IOCs: 7 IOC Types: domain, ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 209[.]38[.]82[.]85:8080 | botnet_cc | 2026-09-24 | 100% |
| ip:port | 209[.]38[.]82[.]85:80 | botnet_cc | 2026-09-24 | 100% |
| ip:port | 82[.]156[.]186[.]185:18443 | botnet_cc | 2026-09-24 | 75% |
| ip:port | 209[.]38[.]82[.]85:443 | botnet_cc | 2026-09-24 | 75% |
| domain | 178-128-196-79.sslip.io | botnet_cc | 2026-09-24 | 75% |
| ip:port | 81[.]70[.]21[.]163:4444 | botnet_cc | 2026-09-24 | 100% |
| ip:port | 81[.]70[.]21[.]163:8088 | botnet_cc | 2026-09-24 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["81.70.21.163", "209.38.82.85", "82.156.186.185"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["81.70.21.163", "209.38.82.85", "82.156.186.185"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Cobalt Strike
let malicious_domains = dynamic(["178-128-196-79.sslip.io"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Legitimate Use of Cobalt Strike for Red Team/Blue Team Exercises: Security teams often deploy Cobalt Strike (or its open-source alternative, Beacon) during authorized penetration tests, red team engagements, or internal chaos engineering exercises to validate detection coverage.
SEC-RedTeam, SecurityOps) or where the process path contains /pentest/ or /redteam/ in the file system path.Development and Testing of Custom Beacons: Developers or security engineers may compile and test custom Cobalt Strike beacons or modified versions in isolated development environments or CI/CD pipelines to verify functionality before deployment.
dev-* or build-*) or where the parent process is a compiler/IDE (e.g., msbuild.exe, code.exe, dotnet.exe).Scheduled Maintenance or Cleanup Jobs: IT operations may use scripts or tools that reference Cobalt Strike IOCs (such as specific mutex names, registry keys, or file paths) for automated cleanup of previous test artifacts or to check for residual files from past engagements.
schtasks.exe, TaskScheduler service) or where the command line contains keywords like cleanup, verify, or audit alongside the IOC.Third-Party Security Tools Integrating Cobalt Strike Detection: Some EDR or SIEM solutions include built-in modules or scripts that actively scan for known Cobalt Strike IOCs as part of their continuous monitoring or threat hunting capabilities.