This hunt targets the presence of known Cobalt Strike indicators of compromise, which adversaries frequently deploy to establish command-and-control channels and execute post-compromise actions. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate compromised assets before the attacker can leverage the framework for lateral movement or data exfiltration.
Malware Family: Cobalt Strike Total IOCs: 12 IOC Types: ip:port, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 213[.]218[.]160[.]253:4444 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 47[.]121[.]130[.]18:8080 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 31[.]70[.]103[.]174:8000 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 212[.]87[.]199[.]197:8081 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 43[.]155[.]246[.]58:80 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 8[.]145[.]61[.]81:8080 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 8[.]145[.]61[.]81:80 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 8[.]145[.]61[.]81:443 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 23[.]227[.]196[.]108:8443 | botnet_cc | 2026-09-12 | 75% |
| ip:port | 162[.]35[.]122[.]126:443 | botnet_cc | 2026-09-12 | 75% |
| ip:port | 139[.]199[.]160[.]80:443 | botnet_cc | 2026-09-12 | 75% |
| domain | networkness.com | botnet_cc | 2026-09-12 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["213.218.160.253", "8.145.61.81", "212.87.199.197", "23.227.196.108", "31.70.103.174", "47.121.130.18", "139.199.160.80", "43.155.246.58", "162.35.122.126"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["213.218.160.253", "8.145.61.81", "212.87.199.197", "23.227.196.108", "31.70.103.174", "47.121.130.18", "139.199.160.80", "43.155.246.58", "162.35.122.126"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Cobalt Strike
let malicious_domains = dynamic(["networkness.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
10.20.0.0/24) or hosts tagged with red-team in CMDB.legacy_app.exe) or known executable paths (e.g., C:\Program Files\InternalTools\) that are registered in the software inventory.svc-backup, backup-admin) or specific scheduled task names (e.g., DailyBackup, SyncAgent) from the alerting logic.192.168.100.0/24) or containers labeled env=dev or project=testing.