This hunt targets adversary command and control activities by identifying network traffic matching four specific Indicators of Compromise (IOCs) linked to the AdaptixC2 infrastructure. Proactive hunting for these signatures in Azure Sentinel is critical to detect early-stage lateral movement or data exfiltration attempts before they escalate into full-blown incidents.
Malware Family: AdaptixC2 Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 94[.]250[.]201[.]212:4321 | botnet_cc | 2026-06-30 | 75% |
| ip:port | 152[.]42[.]164[.]27:65531 | botnet_cc | 2026-06-30 | 75% |
| ip:port | 81[.]90[.]31[.]253:4321 | botnet_cc | 2026-06-29 | 75% |
| ip:port | 193[.]169[.]194[.]63:32333 | botnet_cc | 2026-06-29 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["152.42.164.27", "81.90.31.253", "94.250.201.212", "193.169.194.63"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["152.42.164.27", "81.90.31.253", "94.250.201.212", "193.169.194.63"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule, tailored for an enterprise environment:
Endpoint Management Agent Updates: The deployment of a new version of Microsoft Intune or Jamf Pro agents often involves downloading and executing update packages that match known AdaptixC2 hash signatures. These legitimate background processes may trigger the rule during scheduled maintenance windows (e.g., Tuesday 02:00 UTC).
10.50.10.0/24) or whitelist the specific executable paths for the agent updater (e.g., C:\Program Files\Microsoft Intune Management Extension\UpdateService.exe).Automated Security Scanning Jobs: Scheduled vulnerability scans performed by tools like Tenable Nessus or Qualys frequently utilize internal IOC databases that may overlap with AdaptixC2 indicators. When these scanners probe endpoints or servers, they generate network connections and file access events that mimic the threat signature.
svc-tenable-scan) and restrict alerts to non-business hours if the scan schedule is fixed, or whitelist the specific destination ports used by the scanning engine (e.g., TCP 443/80 from scanner IPs).Third-Party Software Installation via SCCM: The rollout of enterprise software updates through Microsoft Endpoint Configuration Manager (SCCM) often involves downloading installers from external repositories. If a vendor’s installer contains a shared library or component matching an AdaptixC2 IOC, the installation job on thousands of workstations will trigger the rule simultaneously.