This hunt detects adversary activity involving known Cobalt Strike indicators of compromise (IOCs) that signal potential command and control or lateral movement within the network. The SOC team should proactively hunt for these signals in Azure Sentinel to rapidly identify and contain active post-exploitation campaigns before they escalate into broader incidents.
Malware Family: Cobalt Strike Total IOCs: 13 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 47[.]96[.]254[.]114:22 | botnet_cc | 2026-07-24 | 100% |
| ip:port | 47[.]236[.]130[.]154:3443 | botnet_cc | 2026-07-24 | 100% |
| ip:port | 42[.]193[.]22[.]177:80 | botnet_cc | 2026-07-24 | 100% |
| ip:port | 20[.]230[.]138[.]200:443 | botnet_cc | 2026-07-24 | 100% |
| ip:port | 20[.]230[.]138[.]200:22 | botnet_cc | 2026-07-24 | 100% |
| ip:port | 20[.]230[.]138[.]200:8080 | botnet_cc | 2026-07-24 | 100% |
| ip:port | 20[.]230[.]138[.]200:80 | botnet_cc | 2026-07-24 | 100% |
| ip:port | 47[.]116[.]60[.]211:8080 | botnet_cc | 2026-07-24 | 100% |
| ip:port | 47[.]116[.]60[.]211:443 | botnet_cc | 2026-07-24 | 100% |
| ip:port | 47[.]116[.]60[.]211:80 | botnet_cc | 2026-07-24 | 100% |
| ip:port | 8[.]137[.]170[.]3:22 | botnet_cc | 2026-07-24 | 100% |
| ip:port | 8[.]137[.]170[.]3:8443 | botnet_cc | 2026-07-24 | 100% |
| ip:port | 8[.]137[.]170[.]3:8080 | botnet_cc | 2026-07-24 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["47.236.130.154", "47.116.60.211", "42.193.22.177", "20.230.138.200", "8.137.170.3", "47.96.254.114"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["47.236.130.154", "47.116.60.211", "42.193.22.177", "20.230.138.200", "8.137.170.3", "47.96.254.114"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule, along with targeted filtering strategies:
Scenario: Automated Vulnerability Scanning by Qualys or Tenable
java.exe, python.exe) that load specific DLLs or establish outbound connections to known Cobalt Strike beacon infrastructure IPs used for license validation or telemetry, triggering the IOC match.C:\Program Files\Qualys\Agent\* or C:\ProgramData\Tenable\*) and whitelist specific outbound destination IPs known to be part of the vendor’s management cloud.Scenario: Scheduled PowerShell Maintenance Jobs
powershell.exe -ExecutionPolicy Bypass -File ...) that utilize the .NET framework to query Active Directory or manage Group Policy. These scripts often load specific assemblies or invoke network requests that mimic the file hash or registry key patterns associated with Cobalt Strike’s beacon functionality.powershell.exe processes where the command line contains keywords like “Maintenance,” “Backup,” or “GPO” and the parent process is Task Scheduler (svchost.exe -k netsvcs).Scenario: Endpoint Detection and Response (EDR) Telemetry Upload