This hunt targets adversary behavior characterized by the deployment of Cobalt Strike beacons to establish persistent command-and-control channels and execute lateral movement within the network. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early detection of this widely used post-exploitation tool allows the SOC team to disrupt active intrusions before attackers can fully compromise sensitive assets or exfiltrate data.
Malware Family: Cobalt Strike Total IOCs: 12 IOC Types: ip:port, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 176[.]125[.]243[.]228:443 | botnet_cc | 2026-06-28 | 100% |
| ip:port | 45[.]227[.]253[.]121:52445 | botnet_cc | 2026-06-27 | 75% |
| ip:port | 134[.]122[.]135[.]120:18443 | botnet_cc | 2026-06-27 | 75% |
| ip:port | 134[.]122[.]135[.]53:18443 | botnet_cc | 2026-06-27 | 75% |
| ip:port | 103[.]146[.]231[.]107:443 | botnet_cc | 2026-06-27 | 100% |
| ip:port | 103[.]146[.]231[.]107:80 | botnet_cc | 2026-06-27 | 75% |
| ip:port | 47[.]86[.]184[.]71:53 | botnet_cc | 2026-06-27 | 75% |
| domain | test.officeplustool.top | botnet_cc | 2026-06-27 | 75% |
| ip:port | 176[.]121[.]50[.]1:8086 | botnet_cc | 2026-06-27 | 100% |
| ip:port | 47[.]243[.]151[.]183:5555 | botnet_cc | 2026-06-27 | 100% |
| ip:port | 62[.]0[.]120[.]51:443 | botnet_cc | 2026-06-27 | 100% |
| ip:port | 114[.]132[.]199[.]129:443 | botnet_cc | 2026-06-27 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["103.146.231.107", "45.227.253.121", "176.121.50.1", "47.243.151.183", "134.122.135.53", "114.132.199.129", "62.0.120.51", "176.125.243.228", "47.86.184.71", "134.122.135.120"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["103.146.231.107", "45.227.253.121", "176.121.50.1", "47.243.151.183", "134.122.135.53", "114.132.199.129", "62.0.120.51", "176.125.243.228", "47.86.184.71", "134.122.135.120"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Cobalt Strike
let malicious_domains = dynamic(["test.officeplustool.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: Cobalt Strike IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:
Endpoint Detection & Response (EDR) Agent Self-Scanning
C:\Program Files\ThreatFox directory. During this process, the agent’s internal engine generates memory signatures and network handshakes that mimic the specific IOCs associated with Cobalt Strike’s beacon communication, particularly when scanning legacy artifacts left by previous security assessments.C:\Program Files\CrowdStrike\fs.exe or MsMpEng.exe) specifically when accessing files within known security tool installation paths, rather than user data directories.Automated Patch Management Deployment
ccmexec.exe or sms_host_ctrl.exe running under the context of a scheduled task named “PatchDeployment” or similar maintenance windows defined in the SCCM console.Legacy Application Health Checks