This detection rule identifies adversary activity involving Cobalt Strike beacons by matching against a curated set of 13 known indicators of compromise (IOCs). A proactive hunt is essential in Azure Sentinel to rapidly uncover persistent post-exploitation tools that often evade standard signature-based defenses, ensuring early containment of potential command-and-control communications.
Malware Family: Cobalt Strike Total IOCs: 13 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 81[.]69[.]226[.]164:8080 | botnet_cc | 2026-08-22 | 100% |
| ip:port | 81[.]69[.]226[.]164:443 | botnet_cc | 2026-08-22 | 100% |
| ip:port | 118[.]25[.]37[.]47:123 | botnet_cc | 2026-08-22 | 100% |
| ip:port | 206[.]237[.]27[.]61:22 | botnet_cc | 2026-08-22 | 100% |
| ip:port | 206[.]237[.]27[.]61:8080 | botnet_cc | 2026-08-22 | 100% |
| ip:port | 146[.]56[.]225[.]4:8001 | botnet_cc | 2026-08-22 | 75% |
| ip:port | 82[.]156[.]80[.]106:443 | botnet_cc | 2026-08-22 | 75% |
| ip:port | 122[.]51[.]12[.]180:5555 | botnet_cc | 2026-08-22 | 100% |
| ip:port | 101[.]34[.]65[.]69:80 | botnet_cc | 2026-08-22 | 100% |
| ip:port | 123[.]207[.]189[.]99:80 | botnet_cc | 2026-08-22 | 100% |
| ip:port | 43[.]139[.]72[.]114:80 | botnet_cc | 2026-08-22 | 100% |
| ip:port | 43[.]138[.]154[.]24:80 | botnet_cc | 2026-08-22 | 100% |
| ip:port | 45[.]221[.]118[.]46:8443 | botnet_cc | 2026-08-22 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["43.139.72.114", "101.34.65.69", "123.207.189.99", "82.156.80.106", "45.221.118.46", "43.138.154.24", "81.69.226.164", "118.25.37.47", "146.56.225.4", "122.51.12.180", "206.237.27.61"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["43.139.72.114", "101.34.65.69", "123.207.189.99", "82.156.80.106", "45.221.118.46", "43.138.154.24", "81.69.226.164", "118.25.37.47", "146.56.225.4", "122.51.12.180", "206.237.27.61"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding exclusions for the ThreatFox: Cobalt Strike IOCs detection rule in an enterprise environment:
Scenario: Legitimate use of Cobalt Strike by the internal Security Operations Center (SOC) or Red Team during authorized penetration testing exercises.
SEC-REDTEAM-01) to simulate lateral movement and command & control traffic against the production network.SEC-REDTEAM OU (Organizational Unit) or specific IP ranges assigned to the Red Team infrastructure, provided the destination ports match standard C2 channels (e.g., 80, 443, 8080).Scenario: Scheduled automated backup jobs utilizing Cobalt Strike’s “Beacon” module for integrity verification.
BackupIntegrityCheck) on the file server FS-PROD-05 that invokes a custom script wrapping the Cobalt Strike beacon binary to verify data consistency before archiving.C:\Program Files\BackupTools\CobaltBeacon.exe) and restrict the alert trigger to only fire outside of the maintenance window (02:00–04:00 AM local time).Scenario: Third-party vendor access via a managed service portal.
VENDOR-ACCESS VLAN, connecting through a specific bastion host (BASTION-MSSP).