ET Threatview.io High Confidence Cobalt Strike C2 IP group 10
Sourceet/open
CreatedDecember 9, 2021
UpdatedMay 29, 2026
Classificationmisc-attack
alert ip [23.227.202.188,23.227.202.188,23.227.202.188,23.227.202.188,77.73.134.51,23.227.202.66,37.72.168.213,15.197.130.221,103.146.141.98,137.184.49.135,156.96.157.120,194.180.49.135,84.32.190.100,193.168.141.202,23.227.203.14,157.245.102.164,15.197.130.221,37.72.168.213,15.197.130.221,103.146.141.98,15.197.130.221,45.128.222.243,163.123.142.146,5.255.106.106,84.32.128.150,5.181.86.249,77.73.134.23,79.137.202.45,79.137.202.62,45.227.252.253,154.223.165.16,167.172.24.169,172.105.27.61,43.132.222.36,43.132.124.75,77.73.133.84,84.32.191.131,31.172.83.154,154.7.253.11,79.137.207.137,103.146.141.98,179.43.142.47,45.192.182.192,18.194.147.156,79.133.56.243,52.14.55.184,84.32.190.246,84.32.128.99,185.247.224.65,194.165.16.90] any -> $HOME_NET any (msg:"ET Threatview.io High Confidence Cobalt Strike C2 IP group 10"; reference:url,threatview.io/Downloads/High-Confidence-CobaltStrike-C2%20-Feeds.txt; threshold:type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2527009; rev:1621; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag Threatview_CS, signature_severity Major, created_at 2021_12_09, updated_at 2026_05_29;)
Metadata
affected productAny
attack targetAny
deploymentPerimeter
tagThreatview_CS
signature severityMajor
created at2021_12_09
updated at2026_05_29
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!