This detection rule identifies adversary activity by monitoring for specific indicators of compromise linked to the AdaptixC2 command and control infrastructure. Proactive hunting in Azure Sentinel is essential to rapidly detect early-stage lateral movements or data exfiltration attempts associated with this threat actor before they escalate into a broader incident.
Malware Family: AdaptixC2 Total IOCs: 3 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 8[.]137[.]111[.]232:8080 | botnet_cc | 2026-08-21 | 100% |
| ip:port | 8[.]137[.]111[.]232:443 | botnet_cc | 2026-08-21 | 100% |
| ip:port | 8[.]137[.]111[.]232:4433 | botnet_cc | 2026-08-21 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["8.137.111.232"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["8.137.111.232"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding filters for the ThreatFox: AdaptixC2 IOCs detection rule in an enterprise environment:
Legitimate Scenario: The corporate Endpoint Detection and Response (EDR) solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) automatically updates its threat intelligence feed, which includes a shared hash or domain associated with the AdaptixC2 campaign. This triggers an alert when the EDR agent queries the cloud service to validate local indicators against the global database.
falcon-sensor-update) or restrict the rule to exclude processes running under the SYSTEM account with a known publisher signature for the EDR vendor.Legitimate Scenario: A scheduled maintenance job runs nightly using PowerShell to scan internal file servers for compliance artifacts. The script utilizes a third-party security library that references an AdaptixC2 indicator (such as a specific URL or hash) to validate file integrity, causing the detection logic to match the IOCs during the execution window.
powershell.exe process when executed by the scheduled task named “Compliance_Integrity_Scan” or the user account svc-compliance-bot.Legitimate Scenario: The Security Operations Center (SOC) analyst manually runs a threat hunting query using Splunk or Elastic SIEM to correlate recent AdaptixC2 IOCs against historical logs. This internal investigation generates network flows and process events that match the rule’s detection logic, resulting in an alert for the analyst’s own workstation.