This hunt detects adversary activity involving known Cobalt Strike indicators of compromise, which are frequently utilized by threat actors to establish command and control channels during post-exploitation phases. Proactively hunting for these IOCs in Azure Sentinel is critical because Cobalt Strike’s widespread adoption allows attackers to blend with legitimate traffic, making early detection essential to prevent lateral movement and data exfiltration before the adversary establishes a persistent foothold.
Malware Family: Cobalt Strike Total IOCs: 22 IOC Types: sha256_hash, ip:port, md5_hash, url, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 103[.]185[.]249[.]199:5003 | botnet_cc | 2026-08-20 | 100% |
| md5_hash | a16ee9fb562ceae9db13a9e6e683d2c6 | payload | 2026-08-20 | 100% |
| url | hxxps://d34auolpreyu24.cloudfront.net/jquery-3[.]3[.]1.min.js | botnet_cc | 2026-08-20 | 100% |
| ip:port | 124[.]221[.]146[.]23:8000 | botnet_cc | 2026-08-20 | 100% |
| ip:port | 199[.]187[.]25[.]93:8080 | botnet_cc | 2026-08-20 | 100% |
| url | hxxps://20[.]6[.]97[.]231/async/newtab_promos | botnet_cc | 2026-08-20 | 100% |
| url | hxxps://20[.]6[.]97[.]231/async/ddljson | botnet_cc | 2026-08-20 | 100% |
| url | hxxps://20[.]6[.]97[.]231/async/newtab_ogb | botnet_cc | 2026-08-20 | 100% |
| url | hxxps://20[.]6[.]97[.]231/service/update2/json | botnet_cc | 2026-08-20 | 100% |
| url | hxxps://20[.]6[.]97[.]231/gen_204 | botnet_cc | 2026-08-20 | 100% |
| url | hxxps://ntc-redirect.akamai-live.workers.dev/compare/v1[.]44/ | botnet_cc | 2026-08-20 | 100% |
| domain | a.bc[.]285ef6f2.web.mail.cargopaa.com | botnet_cc | 2026-08-20 | 100% |
| md5_hash | 9f0c756af7f4a15a6e801aeb364a832d | payload | 2026-08-20 | 100% |
| sha256_hash | 33215eef229fa578661e017862dbca09c9d9d0a2d19ff56e0622604c804c7ebe | payload | 2026-08-20 | 100% |
| ip:port | 103[.]185[.]249[.]199:8081 | botnet_cc | 2026-08-20 | 100% |
| ip:port | 103[.]185[.]249[.]199:1080 | botnet_cc | 2026-08-20 | 100% |
| ip:port | 103[.]185[.]249[.]199:80 | botnet_cc | 2026-08-20 | 100% |
| ip:port | 103[.]185[.]249[.]199:8080 | botnet_cc | 2026-08-20 | 100% |
| ip:port | 103[.]185[.]249[.]199:443 | botnet_cc | 2026-08-20 | 100% |
| ip:port | 103[.]185[.]249[.]199:22 | botnet_cc | 2026-08-20 | 100% |
| ip:port | 149[.]88[.]66[.]234:8082 | botnet_cc | 2026-08-20 | 100% |
| ip:port | 47[.]96[.]106[.]127:8080 | botnet_cc | 2026-08-20 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["149.88.66.234", "103.185.249.199", "124.221.146.23", "199.187.25.93", "47.96.106.127"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["149.88.66.234", "103.185.249.199", "124.221.146.23", "199.187.25.93", "47.96.106.127"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Cobalt Strike
let malicious_domains = dynamic(["a.bc.285ef6f2.web.mail.cargopaa.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Cobalt Strike
let malicious_urls = dynamic(["https://d34auolpreyu24.cloudfront.net/jquery-3.3.1.min.js", "https://20.6.97.231/async/newtab_promos", "https://20.6.97.231/async/ddljson", "https://20.6.97.231/async/newtab_ogb", "https://20.6.97.231/service/update2/json", "https://20.6.97.231/gen_204", "https://ntc-redirect.akamai-live.workers.dev/compare/v1.44/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - Cobalt Strike
let malicious_hashes = dynamic(["a16ee9fb562ceae9db13a9e6e683d2c6", "9f0c756af7f4a15a6e801aeb364a832d", "33215eef229fa578661e017862dbca09c9d9d0a2d19ff56e0622604c804c7ebe"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceFileEvents | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule, including targeted filters and exclusions:
Scenario: Scheduled Backup Jobs Utilizing Cobalt Strike Beacon
beacon.exe binary (a common Cobalt Strike component) as part of the workflow, which triggers the IOC match on file hash and process name.--mode=verify) or exclude the rule for processes launched by a known service account (e.g., DOMAIN\svc_backup_admin).Scenario: Endpoint Management Tool Deployment via SCCM/Intune
ccmexec.exe (SCCM), msiexec.exe, or IntuneManagementExtension.exe. This ensures that beacon instances spawned by legitimate deployment engines are ignored.Scenario: Internal Penetration Testing and Red Team Exercises