This rule detects the presence of known Cobalt Strike indicators of compromise, which adversaries frequently deploy to establish command-and-control channels and execute post-exploitation actions. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify stealthy intrusions early, reducing the dwell time of attackers who leverage this popular framework to evade standard network monitoring.
Malware Family: Cobalt Strike Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 3[.]89[.]105[.]200:80 | botnet_cc | 2026-09-03 | 100% |
| ip:port | 100[.]56[.]226[.]150:80 | botnet_cc | 2026-09-03 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["100.56.226.150", "3.89.105.200"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["100.56.226.150", "3.89.105.200"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A security team deploys a custom PowerShell script to automate the cleanup of temporary files or staging directories after a red team engagement or internal penetration test, which inadvertently uses the same naming conventions or paths (e.g., C:\Users\Public\beacon.exe or specific GUID-based folder names) targeted by the Cobalt Strike IOCs.
powershell.exe launched by taskeng or a specific service account) and the file path resides within a designated “Red Team Staging” or “Temp” directory that is whitelisted in the EDR policy.Scenario: An IT administrator installs a third-party monitoring agent or a specific vendor’s security tool (such as CrowdStrike Falcon or Carbon Black) that creates a helper executable or configuration file with a name matching one of the two specific IOCs (e.g., a generic name like update.exe or a specific hash if the IOC is hash-based) in a standard system directory like C:\Program Files\VendorName\.
C:\Program Files\ or C:\Program Files (x86)\ and the parent process is a known vendor installer or service (e.g., msiexec.exe, setup.exe, or the vendor’s specific service executable).Scenario: A developer or QA engineer runs a local build script or a CI/CD pipeline agent on a jump box or build server that generates a temporary executable or script with a name matching the Cobalt Strike IOCs (e.g., build_output.exe or a specific GUID-named file) as part of a standard compilation or packaging step, rather than malicious activity.