ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This detection targets adversary command and control activity by identifying network traffic matching five specific Indicators of Compromise (IOCs) linked to the AdaptixC2 framework. Proactive hunting for these IOCs in Azure Sentinel is critical to rapidly identify early-stage lateral movement or data exfiltration attempts before they escalate into broader compromises.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`45[.]156[.]87[.]224:8443`	botnet_cc	2026-08-16	75%
ip:port	`192[.]162[.]199[.]185:38492`	botnet_cc	2026-08-16	75%
ip:port	`154[.]37[.]218[.]235:8080`	botnet_cc	2026-08-15	100%
ip:port	`154[.]37[.]218[.]235:443`	botnet_cc	2026-08-15	100%
ip:port	`154[.]37[.]218[.]235:80`	botnet_cc	2026-08-15	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["192.162.199.185", "154.37.218.235", "45.156.87.224"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["192.162.199.185", "154.37.218.235", "45.156.87.224"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AdaptixC2

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Automated Endpoint Security Scans
- Context: Enterprise EDR agents (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) perform periodic background scans that query known threat intelligence feeds. If the AdaptixC2 IOCs are present in a public feed consumed by these agents, the scan process itself may generate network traffic matching the rule’s signatures.
- Filter/Exclusion: Exclude traffic originating from specific EDR service accounts (e.g., MSSQL$EDRService, CrowdStrikeFalcon) or filter logs where the process name is MsMpEng.exe or CSFalconService.exe and the user context is a local system account.
Scenario: Scheduled Threat Intelligence Ingestion Jobs
- Context: Security Operations teams often run scheduled PowerShell scripts (e.g., via Task Scheduler) to ingest new IOCs from external platforms like ThreatFox or MISP into internal SIEMs. These jobs may actively probe the AdaptixC2 indicators as part of a validation step, triggering the detection rule during execution windows.
- Filter/Exclusion: Create an exclusion based on the Process Name being powershell.exe and the command line containing keywords like -ImportThreats, -AdaptixC2, or specific script paths (e.g., C:\Scripts\DailyIOCUpdate.ps1). Additionally, exclude events occurring during known maintenance windows (e.g., 02:00–04:00 UTC).
Scenario: Admin-Driven Manual IOC Verification
- Context: Security analysts or system administrators manually run diagnostic tools (such as nslookup, `curl