This hypothesis targets the presence of known Cobalt Strike indicators, which adversaries frequently deploy to establish command-and-control channels and execute post-exploitation actions within the network. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised assets early, potentially disrupting the attacker’s operational tempo before they achieve lateral movement or data exfiltration.
Malware Family: Cobalt Strike Total IOCs: 3 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 206[.]237[.]120[.]90:8443 | botnet_cc | 2026-09-07 | 100% |
| ip:port | 144[.]172[.]68[.]200:801 | botnet_cc | 2026-09-07 | 100% |
| ip:port | 45[.]221[.]118[.]38:8443 | botnet_cc | 2026-09-07 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["206.237.120.90", "144.172.68.200", "45.221.118.38"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["206.237.120.90", "144.172.68.200", "45.221.118.38"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
redteam or pentest in your CMDB or asset inventory, or create a time-based suppression window for known exercise dates.beacon binary or its associated IOCs (such as specific mutexes or file paths) as part of custom internal deployment agents or service mesh sidecars that were not fully sanitized.
svc-deploy, svc-automation) or known internal application directories (e.g., C:\Apps\InternalTools\) from the IOC matching criteria.vendor-support, partner-access) or correlate alerts with active vendor ticket IDs in your ITSM system.legacy-crm.exe, old-inventory-tool.exe) or their parent processes in the detection rule’s exclusion list.