ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt detects adversary activity involving known AdaptixC2 command and control infrastructure by identifying network connections to specific threat intelligence indicators. Proactively hunting for these IOCs in Azure Sentinel is critical to rapidly identify early-stage compromise attempts before they escalate into full-blown incidents within the organization’s cloud environment.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 13 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`164[.]90[.]202[.]48:8080`	botnet_cc	2026-07-14	100%
ip:port	`164[.]90[.]202[.]48:80`	botnet_cc	2026-07-14	100%
ip:port	`164[.]90[.]202[.]48:443`	botnet_cc	2026-07-14	100%
ip:port	`96[.]9[.]231[.]213:4321`	botnet_cc	2026-07-14	75%
ip:port	`47[.]109[.]181[.]81:4321`	botnet_cc	2026-07-14	75%
ip:port	`35[.]78[.]107[.]61:4321`	botnet_cc	2026-07-14	75%
ip:port	`20[.]226[.]72[.]17:4321`	botnet_cc	2026-07-14	75%
ip:port	`172[.]232[.]122[.]241:4321`	botnet_cc	2026-07-14	75%
ip:port	`164[.]90[.]202[.]48:4321`	botnet_cc	2026-07-14	75%
ip:port	`139[.]199[.]87[.]99:4321`	botnet_cc	2026-07-14	75%
ip:port	`118[.]89[.]121[.]171:4321`	botnet_cc	2026-07-14	75%
ip:port	`158[.]94[.]211[.]63:8080`	botnet_cc	2026-07-14	100%
ip:port	`158[.]94[.]211[.]63:443`	botnet_cc	2026-07-14	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["96.9.231.213", "139.199.87.99", "164.90.202.48", "20.226.72.17", "172.232.122.241", "35.78.107.61", "47.109.181.81", "118.89.121.171", "158.94.211.63"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["96.9.231.213", "139.199.87.99", "164.90.202.48", "20.226.72.17", "172.232.122.241", "35.78.107.61", "47.109.181.81", "118.89.121.171", "158.94.211.63"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AdaptixC2

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: AdaptixC2 IOCs detection rule in an enterprise environment:

Endpoint Security Management Updates
- Scenario: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) automatically downloads and executes a signature update or a new sensor module. If the vendor has recently integrated AdaptixC2 telemetry into their threat intelligence feed, the legitimate installation of this update package may trigger the rule by matching one of the 13 IOCs (such as a specific hash or network domain).
- Suggested Filter: Create an exclusion based on the Process Name and Parent Process. Exclude events where the process is part of the known EDR service (e.g., C:\Program Files\CrowdStrike\fsagent.exe) or specifically filter out traffic originating from the vendor’s update servers (e.g., *.crowdstrike.com, *.microsoft.com).
Scheduled Patch Management Deployments
- Scenario: A nightly scheduled task executed by a patch management tool (such as SCCM/MECM, Ivanti, or ManageEngine) pushes a critical security patch to the domain. This patch might include a new library or script that references an AdaptixC2 IOC for verification purposes during the installation phase, causing the detection logic to flag the deployment activity as suspicious.
- Suggested Filter: Implement a time-based exclusion combined with User Account filtering. Exclude alerts occurring between 01:00 and 05:00 UTC originating from service accounts used for patching (e.g., DOMAIN\svc-patch-deploy, SYSTEM) or filter by the specific Command Line arguments associated with the patch installer executable.
Cloud Identity and Access Management (IAM) Integrations