ET Threatview.io High Confidence Cobalt Strike C2 IP group 13
Sourceet/open
Filethreatview_CS_c2.rules
CreatedDecember 9, 2021
UpdatedJuly 16, 2026
Classificationmisc-attack
alert ip [139.60.161.43,64.44.98.227,89.185.85.17,23.106.215.64,23.106.215.139,108.62.118.185,213.227.154.170,64.44.98.23,23.81.246.209,23.19.58.163,45.147.229.22,206.189.236.243,84.32.188.234,84.32.188.234,84.32.188.234,84.32.188.234,84.32.188.234,84.32.188.234,84.32.188.234,84.32.188.234,84.32.188.234,84.32.188.234,84.32.188.234,84.32.188.234,84.32.188.234,84.32.188.234,84.32.188.234,84.32.188.234,84.32.188.234,84.32.188.234,84.32.188.234,84.32.188.234,84.32.188.234,84.32.188.234,84.32.188.234,139.60.161.213,139.60.161.213,84.32.188.234,84.32.188.238,23.29.115.190,54.169.204.154,146.70.116.20,149.255.35.160,185.244.212.126,68.233.238.123,104.156.59.221,23.29.115.140,194.165.16.53,45.66.248.203,45.147.229.157] any -> $HOME_NET any (msg:"ET Threatview.io High Confidence Cobalt Strike C2 IP group 13"; reference:url,threatview.io/Downloads/High-Confidence-CobaltStrike-C2%20-Feeds.txt ; threshold:type limit, track by_src, seconds 3600, count 1 ; classtype:misc-attack; sid:2527012; rev:1669; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag Threatview_CS, signature_severity Major, created_at 2021_12_09, updated_at 2026_07_16;)
Metadata
affected productAny
attack targetAny
deploymentPerimeter
tagThreatview_CS
signature severityMajor
created at2021_12_09
updated at2026_07_16
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!