ET Threatview.io High Confidence Cobalt Strike C2 IP group 22

7.0.3 5.0SID: 2527021Rev: 1669EnabledDerived141 viewsHistory

Filethreatview_CS_c2.rules

CreatedDecember 9, 2021

UpdatedJuly 16, 2026

Classificationmisc-attack

alert ip [165.227.85.160,167.99.197.196] any -> $HOME_NET any (msg:"ET Threatview.io High Confidence Cobalt Strike C2 IP group 22"; reference:url,threatview.io/Downloads/High-Confidence-CobaltStrike-C2%20-Feeds.txt; threshold:type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2527021; rev:1669; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag Threatview_CS, signature_severity Major, created_at 2021_12_09, updated_at 2026_07_16;)

References

url	threatview.io/Downloads/High-Confidence-CobaltStrike-C2%20-Feeds.txt

Metadata

affected productAny

attack targetAny

deploymentPerimeter

tagThreatview_CS

signature severityMajor

created at2021_12_09

updated at2026_07_16

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!