Inbound Connection from a Cobalt Strike IP Address

Cobalt Strike is an attack toolkit that is often associated with malicious activity. Attackers install the Cobalt Strike Beacon payload on a compromised device and the beacon initiates a connection to a C&C server, referred to as the Cobalt Strike team server. Cobalt Strike team servers are designed to receive communications from a compromised device but do not usually initiate connections. A connection from a known Cobalt Strike server might mean an attacker is repurposing the server to conduct reconnaissance or other malicious activity.