This hunt targets the presence of eight known Indicators of Compromise (IOCs) associated with Cobalt Strike, a widely used adversary framework for establishing command-and-control channels and executing post-exploitation actions. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify and isolate compromised assets early, mitigating the risk of persistent access and lateral movement by sophisticated threat actors.
Malware Family: Cobalt Strike Total IOCs: 8 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 42[.]193[.]169[.]176:80 | botnet_cc | 2026-09-19 | 75% |
| ip:port | 47[.]122[.]120[.]188:81 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 101[.]34[.]208[.]175:8081 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 139[.]199[.]18[.]159:81 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 35[.]215[.]160[.]200:80 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 123[.]57[.]146[.]34:80 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 114[.]215[.]190[.]7:443 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 167[.]179[.]67[.]162:8443 | botnet_cc | 2026-09-19 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["123.57.146.34", "114.215.190.7", "42.193.169.176", "167.179.67.162", "139.199.18.159", "101.34.208.175", "47.122.120.188", "35.215.160.200"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["123.57.146.34", "114.215.190.7", "42.193.169.176", "167.179.67.162", "139.199.18.159", "101.34.208.175", "47.122.120.188", "35.215.160.200"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Legitimate Internal Red Team or Penetration Testing: During authorized security assessments, internal red teams often deploy Cobalt Strike to simulate adversary behaviors. This can trigger IOC matches if the team uses standard default configurations or known hashes.
svc_redteam) during scheduled testing windows.Software Development and QA Environments: Developers and QA engineers may use Cobalt Strike in isolated virtual machines or containers to test application resilience, debug network protocols, or validate security controls. These environments often run unpatched or custom builds that match known IOCs.
env=dev or env=qa in your asset inventory, or exclude processes launched from specific development directories (e.g., C:\Projects\, C:\QA\) on non-production servers.Legacy or Third-Party Application Dependencies: Some older or niche enterprise applications (particularly in finance or industrial control systems) may bundle or reference Cobalt Strike components for specific communication or testing modules, leading to false positive hash or string matches.
C:\Program Files\LegacyApp\bin\), or suppress alerts for specific process names (e.g., legacy_comm.exe) that have been verified as safe.Scheduled Maintenance and Backup Jobs: Certain backup or maintenance scripts may inadvertently copy or reference Cobalt Strike artifacts (such as configuration files or test binaries) during full system backups or disk imaging processes, triggering file-based IOCs.