← Back to SOC feed Coverage →

ThreatFox: Cobalt Strike IOCs

ioc-hunt HIGH ThreatFox
CommonSecurityLogDeviceNetworkEvents
cobalt-strikeiocthreatfoxwin-cobalt_strike
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at ThreatFox →
Retrieved: 2026-08-09T23:00:00Z · Confidence: high

Hunt Hypothesis

This detection rule identifies adversary activity involving specific Indicators of Compromise (IOCs) linked to Cobalt Strike, a widely used post-exploitation tool often employed for command and control or lateral movement within compromised networks. The SOC team should proactively hunt for these signatures in Azure Sentinel to rapidly detect early-stage intrusions by threat actors leveraging this framework, thereby minimizing dwell time before the adversary establishes persistence or exfiltrates sensitive data.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 4 IOC Types: ip:port

TypeValueThreat TypeFirst SeenConfidence
ip:port36[.]140[.]162[.]173:12443botnet_cc2026-08-09100%
ip:port169[.]58[.]82[.]229:3389botnet_cc2026-08-09100%
ip:port139[.]196[.]111[.]118:111botnet_cc2026-08-09100%
ip:port139[.]196[.]111[.]118:22botnet_cc2026-08-09100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["169.58.82.229", "36.140.162.173", "139.196.111.118"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["169.58.82.229", "36.140.162.173", "139.196.111.118"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DeviceNetworkEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

Original source: https://threatfox.abuse.ch/browse/malware/win.cobalt_strike/