Hunt package for 14 IOCs associated with Cobalt Strike
Malware Family: Cobalt Strike Total IOCs: 14 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 165[.]154[.]244[.]77:2562 | botnet_cc | 2026-03-19 | 100% |
| ip:port | 106[.]75[.]230[.]47:80 | botnet_cc | 2026-03-18 | 100% |
| ip:port | 156[.]234[.]233[.]169:37611 | botnet_cc | 2026-03-18 | 100% |
| ip:port | 156[.]234[.]233[.]184:37611 | botnet_cc | 2026-03-18 | 100% |
| ip:port | 156[.]234[.]233[.]180:37611 | botnet_cc | 2026-03-18 | 100% |
| ip:port | 156[.]234[.]226[.]39:37611 | botnet_cc | 2026-03-18 | 100% |
| ip:port | 156[.]234[.]56[.]48:37611 | botnet_cc | 2026-03-18 | 100% |
| ip:port | 121[.]41[.]177[.]231:80 | botnet_cc | 2026-03-18 | 100% |
| ip:port | 156[.]234[.]226[.]61:37611 | botnet_cc | 2026-03-18 | 100% |
| ip:port | 156[.]234[.]190[.]110:37611 | botnet_cc | 2026-03-18 | 100% |
| ip:port | 156[.]234[.]216[.]49:37611 | botnet_cc | 2026-03-18 | 100% |
| ip:port | 156[.]234[.]233[.]185:37611 | botnet_cc | 2026-03-18 | 100% |
| ip:port | 156[.]234[.]226[.]46:37611 | botnet_cc | 2026-03-18 | 100% |
| ip:port | 78[.]155[.]221[.]67:8078 | botnet_cc | 2026-03-18 | 50% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Cobalt Strike
let malicious_ips = dynamic(["106.75.230.47", "156.234.233.184", "156.234.233.180", "156.234.226.61", "156.234.233.169", "156.234.226.46", "156.234.190.110", "78.155.221.67", "156.234.216.49", "121.41.177.231", "156.234.56.48", "156.234.226.39", "156.234.233.185", "165.154.244.77"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["106.75.230.47", "156.234.233.184", "156.234.233.180", "156.234.226.61", "156.234.233.169", "156.234.226.46", "156.234.190.110", "78.155.221.67", "156.234.216.49", "121.41.177.231", "156.234.56.48", "156.234.226.39", "156.234.233.185", "165.154.244.77"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |