This hunt detects adversary behavior characterized by the deployment of Cobalt Strike beacons, which are frequently utilized in post-exploitation phases to establish persistent command and control channels within Azure Sentinel environments. Proactive hunting for these specific IOCs is critical because early identification of Cobalt Strike artifacts enables the SOC team to rapidly isolate compromised hosts before adversaries can expand their lateral movement or exfiltrate sensitive data.
Malware Family: Cobalt Strike Total IOCs: 9 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 118[.]25[.]50[.]96:80 | botnet_cc | 2026-09-02 | 100% |
| ip:port | 8[.]148[.]26[.]139:8086 | botnet_cc | 2026-09-02 | 100% |
| ip:port | 47[.]103[.]213[.]138:6443 | botnet_cc | 2026-09-02 | 50% |
| ip:port | 62[.]234[.]72[.]163:443 | botnet_cc | 2026-09-02 | 50% |
| ip:port | 175[.]178[.]230[.]164:443 | botnet_cc | 2026-09-02 | 50% |
| ip:port | 120[.]53[.]238[.]38:443 | botnet_cc | 2026-09-02 | 50% |
| ip:port | 35[.]183[.]184[.]246:443 | botnet_cc | 2026-09-02 | 50% |
| ip:port | 54[.]158[.]87[.]112:443 | botnet_cc | 2026-09-02 | 50% |
| ip:port | 114[.]66[.]27[.]110:22 | botnet_cc | 2026-09-02 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["120.53.238.38", "8.148.26.139", "118.25.50.96", "175.178.230.164", "54.158.87.112", "35.183.184.246", "62.234.72.163", "47.103.213.138", "114.66.27.110"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["120.53.238.38", "8.148.26.139", "118.25.50.96", "175.178.230.164", "54.158.87.112", "35.183.184.246", "62.234.72.163", "47.103.213.138", "114.66.27.110"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:
Scenario: Scheduled Vulnerability Scanning via Nessus or Qualys
10.20.5.0/24) and filter out alerts where the process name matches known scanner executables like Nessus.exe, qualyspc.exe, or qagent.Scenario: Microsoft Endpoint Configuration Manager (SCCM) Client Heartbeats
ccmexec.exe) performs regular heartbeat checks and policy downloads to the site server. This traffic often involves consistent TLS connections at fixed intervals, which can trigger IOCs related to Cobalt Strike’s command-and-control (C2) beaconing behavior.ccmexec.exe running under the context of the System or Local System account. Additionally, exclude traffic destined for known internal SCCM site server FQDNs (e.g., *.scm.company.local).Scenario: Automated Backup Jobs via Veeam or Commvault