This hypothesis targets the presence of known Cobalt Strike indicators, which adversaries frequently leverage to establish command-and-control channels and execute post-compromise actions within the environment. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify active or dormant beaconing activity before it escalates into lateral movement or data exfiltration, thereby reducing the dwell time of sophisticated threat actors.
Malware Family: Cobalt Strike Total IOCs: 10 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 45[.]86[.]64[.]228:80 | botnet_cc | 2026-09-15 | 100% |
| ip:port | 45[.]86[.]64[.]228:3389 | botnet_cc | 2026-09-15 | 100% |
| ip:port | 45[.]86[.]64[.]228:443 | botnet_cc | 2026-09-15 | 100% |
| ip:port | 121[.]43[.]152[.]104:22222 | botnet_cc | 2026-09-15 | 100% |
| ip:port | 45[.]86[.]64[.]228:22 | botnet_cc | 2026-09-15 | 100% |
| ip:port | 121[.]43[.]152[.]104:7000 | botnet_cc | 2026-09-15 | 100% |
| ip:port | 31[.]70[.]103[.]174:22 | botnet_cc | 2026-09-15 | 100% |
| ip:port | 118[.]25[.]43[.]125:443 | botnet_cc | 2026-09-15 | 100% |
| ip:port | 121[.]43[.]152[.]104:2202 | botnet_cc | 2026-09-15 | 100% |
| ip:port | 121[.]43[.]152[.]104:443 | botnet_cc | 2026-09-15 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["118.25.43.125", "31.70.103.174", "45.86.64.228", "121.43.152.104"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc
// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["118.25.43.125", "31.70.103.174", "45.86.64.228", "121.43.152.104"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
SecurityTeam or PenTesters in Active Directory, or correlate with a ticket ID in the CMDB for the active engagement window.Dev-Cluster or QA-Subnet resource groups, or filter out events where the source IP is within the designated non-production CIDR range (e.g., 10.20.0.0/16).C:\Program Files\LegacyApp\bin\cobalt.dll) or exclude processes where the parent process is a known legacy service (e.g., LegacyAppService.exe).02:00-04:00 UTC) on hosts running the BackupAgent service, or filter out network connections where the destination port matches the internal backup port (e.g., 4444 if used locally).