← Back to SOC feed Coverage →

ThreatFox: AdaptixC2 IOCs

ioc-hunt HIGH ThreatFox
CommonSecurityLogDeviceNetworkEvents
aptiocthreatfoxwin-adaptix_c2
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at ThreatFox →
Retrieved: 2026-09-13T11:00:00Z · Confidence: high

Hunt Hypothesis

This hunt targets known indicators of compromise associated with the AdaptixC2 framework to identify potential command-and-control infrastructure or malicious endpoints within the environment. Proactively hunting for these IOCs allows the SOC to detect early-stage adversary activity and establish a foothold before the threat actor can fully execute their post-exploitation objectives.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 3 IOC Types: ip:port

TypeValueThreat TypeFirst SeenConfidence
ip:port162[.]35[.]172[.]146:8080botnet_cc2026-09-13100%
ip:port162[.]35[.]172[.]146:443botnet_cc2026-09-13100%
ip:port162[.]35[.]172[.]146:80botnet_cc2026-09-13100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["162.35.172.146"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["162.35.172.146"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DeviceNetworkEventsEnsure this data connector is enabled

References

False Positive Guidance

Original source: https://threatfox.abuse.ch/browse/malware/win.adaptix_c2/