ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt targets adversary command and control activities by identifying network traffic matching eight specific Indicators of Compromise (IOCs) linked to the AdaptixC2 infrastructure. Proactively hunting for these signatures in Azure Sentinel is critical to detect early-stage lateral movement or data exfiltration attempts before they escalate into a confirmed incident.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 8 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`45[.]150[.]38[.]95:4321`	botnet_cc	2026-06-28	75%
ip:port	`85[.]137[.]249[.]185:8977`	botnet_cc	2026-06-27	75%
ip:port	`80[.]211[.]129[.]141:1234`	botnet_cc	2026-06-27	75%
ip:port	`68[.]64[.]178[.]130:48951`	botnet_cc	2026-06-27	75%
ip:port	`69[.]48[.]228[.]170:65531`	botnet_cc	2026-06-27	75%
ip:port	`45[.]141[.]234[.]47:4321`	botnet_cc	2026-06-27	75%
ip:port	`37[.]220[.]31[.]90:61135`	botnet_cc	2026-06-27	75%
ip:port	`138[.]124[.]84[.]7:4321`	botnet_cc	2026-06-27	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["69.48.228.170", "68.64.178.130", "37.220.31.90", "45.150.38.95", "138.124.84.7", "45.141.234.47", "80.211.129.141", "85.137.249.185"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["69.48.228.170", "68.64.178.130", "37.220.31.90", "45.150.38.95", "138.124.84.7", "45.141.234.47", "80.211.129.141", "85.137.249.185"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AdaptixC2

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule in an enterprise environment, along with recommended filters or exclusions:

Endpoint Security Policy Updates via Central Management Console
- Scenario: The central management server (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon, or SentinelOne) pushes a policy update containing the AdaptixC2 IOCs to all managed agents. This triggers network connections from the security console to the endpoints and internal DNS lookups that match the rule’s signature.
- Filter/Exclusion: Exclude traffic originating from known Security Management Server IP ranges (e.g., 10.50.1.10-20) or filter events where the Source User is a dedicated service account like svc-security-updater.
Scheduled Vulnerability Scanning Jobs
- Scenario: A scheduled vulnerability assessment job runs weekly using tools like Tenable Nessus, Qualys, or Rapid7 InsightVM. These scanners actively probe internal assets and may download definition updates or communicate with external threat intelligence feeds that include the specific AdaptixC2 IOCs as part of their baseline knowledge base.
- Filter/Exclusion: Create a rule exception for hostnames containing _scanner or vuln-scan (e.g., tenable-scanner-01.corp.local) and restrict the exclusion to specific scheduled time windows (e.g., Sundays 02:00–06:00 UTC).
Software Deployment via Configuration Management
- Scenario: The IT Operations team executes a standard software deployment using Microsoft SCCM, Ansible, or Puppet. During the deployment of a new application package, the configuration management server downloads dependencies and validates certificates against external repositories that host the AdaptixC2 indicators as trusted artifacts.