← Back to SOC feed Coverage →

ThreatFox: Cobalt Strike IOCs

ioc-hunt HIGH ThreatFox
CommonSecurityLogDeviceNetworkEvents
cobalt-strikeiocthreatfoxwin-cobalt_strike
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at ThreatFox →
Retrieved: 2026-07-19T11:00:00Z · Confidence: high

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging Cobalt Strike beacons to establish persistent command-and-control channels and execute lateral movement within the network. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early detection of this widely used post-exploitation tool allows the SOC team to disrupt active intrusions before they escalate into significant data exfiltration or ransomware deployment events.

IOC Summary

Malware Family: Cobalt Strike Total IOCs: 20 IOC Types: ip:port

TypeValueThreat TypeFirst SeenConfidence
ip:port154[.]12[.]85[.]75:80botnet_cc2026-07-19100%
ip:port47[.]116[.]60[.]211:8443botnet_cc2026-07-19100%
ip:port159[.]75[.]195[.]231:5004botnet_cc2026-07-19100%
ip:port119[.]45[.]160[.]160:111botnet_cc2026-07-19100%
ip:port51[.]222[.]87[.]16:22botnet_cc2026-07-19100%
ip:port51[.]222[.]87[.]16:21botnet_cc2026-07-19100%
ip:port101[.]33[.]225[.]32:123botnet_cc2026-07-19100%
ip:port101[.]42[.]255[.]92:8082botnet_cc2026-07-19100%
ip:port101[.]42[.]255[.]92:5353botnet_cc2026-07-19100%
ip:port101[.]33[.]225[.]32:3306botnet_cc2026-07-19100%
ip:port101[.]42[.]255[.]92:137botnet_cc2026-07-19100%
ip:port101[.]33[.]225[.]32:22botnet_cc2026-07-19100%
ip:port101[.]33[.]225[.]32:13306botnet_cc2026-07-19100%
ip:port49[.]233[.]136[.]227:18082botnet_cc2026-07-19100%
ip:port49[.]233[.]136[.]227:22botnet_cc2026-07-19100%
ip:port47[.]108[.]60[.]27:22botnet_cc2026-07-19100%
ip:port101[.]200[.]193[.]211:8000botnet_cc2026-07-19100%
ip:port101[.]200[.]193[.]211:44321botnet_cc2026-07-19100%
ip:port38[.]76[.]169[.]75:870botnet_cc2026-07-1875%
ip:port130[.]94[.]34[.]66:6666botnet_cc2026-07-1875%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["130.94.34.66", "101.42.255.92", "51.222.87.16", "47.108.60.27", "101.200.193.211", "119.45.160.160", "154.12.85.75", "159.75.195.231", "47.116.60.211", "49.233.136.227", "38.76.169.75", "101.33.225.32"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["130.94.34.66", "101.42.255.92", "51.222.87.16", "47.108.60.27", "101.200.193.211", "119.45.160.160", "154.12.85.75", "159.75.195.231", "47.116.60.211", "49.233.136.227", "38.76.169.75", "101.33.225.32"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DeviceNetworkEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Original source: https://threatfox.abuse.ch/browse/malware/win.cobalt_strike/