This rule detects the presence of known Cobalt Strike indicators of compromise, which adversaries frequently leverage to establish encrypted command-and-control channels and execute post-exploitation actions following initial access. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify stealthy C2 infrastructure and potential data exfiltration attempts before they progress to lateral movement or privilege escalation.
Malware Family: Cobalt Strike Total IOCs: 8 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 223[.]109[.]142[.]7:80 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 223[.]109[.]142[.]7:8080 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 111[.]231[.]116[.]164:22 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 192[.]252[.]179[.]24:65530 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 223[.]109[.]142[.]7:443 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 111[.]231[.]116[.]164:80 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 111[.]231[.]116[.]164:8080 | botnet_cc | 2026-09-05 | 100% |
| ip:port | 111[.]231[.]116[.]164:443 | botnet_cc | 2026-09-05 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["192.252.179.24", "111.231.116.164", "223.109.142.7"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["192.252.179.24", "111.231.116.164", "223.109.142.7"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Penetration Testing and Red Team Exercises: During authorized security assessments, red teams often deploy Cobalt Strike beacons to simulate advanced persistent threats (APTs) and test detection capabilities. This can trigger alerts for known IOCs such as specific mutexes, registry keys, or network connections to known C2 infrastructure.
red-team or pentest in your CMDB or asset inventory during scheduled testing periods. Additionally, whitelist specific IP ranges or domains used by the pentest team if they are static.Legacy Application Maintenance and Debugging: Some older enterprise applications or custom internal tools may use Cobalt Strike’s underlying frameworks or similar C2 mechanisms for remote debugging, log collection, or emergency maintenance access. For example, a legacy ERP system might use a beacon-like mechanism to push configuration updates or pull diagnostic data.
beacon.exe, cobalt.exe) or parent processes associated with these legacy apps. Exclude alerts where the Cobalt Strike IOC is spawned by known service accounts or specific application binaries (e.g., legacy_erp_service.exe) and verify that the network traffic is limited to internal maintenance subnets.Scheduled Backup and Disaster Recovery Tools: Certain backup or disaster recovery solutions may use encrypted channels or specific C2-like protocols to coordinate data exfiltration or restoration tasks. If these tools share similar IOCs (e.g., specific TLS certificates, user-agent strings, or port usage) with Cobalt Strike, they can trigger false positives.
VeeamAgent.exe, CommCellAgent.exe) or services running under dedicated backup service accounts. Verify that