This detection rule identifies adversary activity involving Cobalt Strike beacon indicators, which are frequently utilized by threat actors to establish persistent command and control channels within compromised networks. Proactive hunting for these specific IOCs in Azure Sentinel is critical because early identification of Cobalt Strike artifacts enables the SOC team to rapidly isolate affected assets before adversaries can pivot laterally or exfiltrate sensitive data.
Malware Family: Cobalt Strike Total IOCs: 17 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 193[.]160[.]32[.]138:443 | botnet_cc | 2026-08-26 | 100% |
| ip:port | 193[.]160[.]32[.]138:80 | botnet_cc | 2026-08-26 | 100% |
| ip:port | 137[.]175[.]107[.]108:80 | botnet_cc | 2026-08-26 | 100% |
| ip:port | 106[.]54[.]44[.]181:89 | botnet_cc | 2026-08-26 | 100% |
| ip:port | 101[.]34[.]216[.]243:6443 | botnet_cc | 2026-08-26 | 100% |
| ip:port | 193[.]160[.]32[.]138:8080 | botnet_cc | 2026-08-26 | 100% |
| ip:port | 193[.]160[.]32[.]138:8088 | botnet_cc | 2026-08-26 | 100% |
| ip:port | 113[.]31[.]113[.]209:8080 | botnet_cc | 2026-08-26 | 100% |
| ip:port | 113[.]31[.]113[.]209:443 | botnet_cc | 2026-08-26 | 100% |
| ip:port | 101[.]43[.]53[.]103:8081 | botnet_cc | 2026-08-26 | 100% |
| ip:port | 101[.]43[.]53[.]103:9999 | botnet_cc | 2026-08-26 | 100% |
| ip:port | 113[.]31[.]113[.]209:22 | botnet_cc | 2026-08-26 | 100% |
| ip:port | 101[.]43[.]53[.]103:111 | botnet_cc | 2026-08-26 | 100% |
| ip:port | 101[.]43[.]53[.]103:53 | botnet_cc | 2026-08-26 | 100% |
| ip:port | 101[.]43[.]53[.]103:443 | botnet_cc | 2026-08-26 | 100% |
| ip:port | 101[.]43[.]53[.]103:80 | botnet_cc | 2026-08-26 | 100% |
| ip:port | 101[.]43[.]53[.]103:22 | botnet_cc | 2026-08-26 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["137.175.107.108", "101.34.216.243", "113.31.113.209", "106.54.44.181", "101.43.53.103", "193.160.32.138"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["137.175.107.108", "101.34.216.243", "113.31.113.209", "106.54.44.181", "101.43.53.103", "193.160.32.138"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding filters for the ThreatFox: Cobalt Strike IOCs detection rule in an enterprise environment:
Scenario: Automated Vulnerability Scanning by Qualys or Tenable
svc-qualys, tenable-daemon) and restrict the rule to exclude specific destination IP ranges associated with the vendor’s cloud management endpoints.Scenario: Scheduled PowerShell Jobs for Patch Management
powershell.exe) to execute patching scripts or configuration audits. These jobs often establish outbound connections to internal update repositories that share similar TLS fingerprint characteristics with Cobalt Strike’s C2 traffic, particularly if the script uses a generic HTTP client library.Task Scheduler (svchost.exe or taskscheduler.exe) and filter out connections where the destination port is 443 but the source process command line contains keywords like “Patch,” “Update,” or specific internal repository URLs.Scenario: Endpoint Detection & Response (EDR) Telemetry Uploads