ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific Indicators of Compromise (IOCs) linked to the AdaptixC2 command and control infrastructure, signaling potential active reconnaissance or data exfiltration attempts within the network. A SOC team should proactively hunt for these IOCs in Azure Sentinel to identify early-stage compromises that may evade standard signature-based detections, thereby reducing dwell time before lateral movement occurs.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 3 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`152[.]32[.]133[.]192:7001`	botnet_cc	2026-08-20	50%
ip:port	`1[.]14[.]104[.]208:4321`	botnet_cc	2026-08-20	50%
ip:port	`50[.]6[.]44[.]138:4321`	botnet_cc	2026-08-20	50%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["152.32.133.192", "50.6.44.138", "1.14.104.208"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["152.32.133.192", "50.6.44.138", "1.14.104.208"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AdaptixC2

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

Scenario: Scheduled Endpoint Protection Updates via Microsoft Defender
- Context: The AdaptixC2 campaign often utilizes standard HTTP/HTTPS traffic patterns that mimic legitimate software update mechanisms. In many enterprises, the scheduled daily update task for Microsoft Defender for Endpoint (or legacy Symantec Endpoint Protection) connects to known vendor update servers using SHA-1 or SHA-256 hashes that may overlap with AdaptixC2’s initial IOCs.
- Filter/Exclusion: Create a rule exclusion based on the process name MsMpEng.exe (or Rtvscan64.exe) where the destination IP belongs to the vendor’s trusted update subnet (e.g., Microsoft Azure CDN ranges). Additionally, exclude alerts generated during the defined maintenance window (e.g., 02:00–04:00 local time) when these updates are pushed.
Scenario: Admin-Initiated PowerShell Script Execution for Patch Management
- Context: System administrators frequently use PowerShell to execute custom scripts that query external threat intelligence feeds or download patch manifests from internal repositories. If the script invokes a curl or Invoke-RestMethod command against an internal repository that shares a certificate fingerprint with AdaptixC2’s IOCs, it triggers a match.
- Filter/Exclusion: Implement a filter to exclude events where the user context is a member of the “Enterprise Administrators” or “Patch Management Group.” Furthermore, add a condition to suppress alerts if the parent process is PowerShell.exe and the command line contains specific keywords like -Command, Get-Package, or references to internal repository URLs (e.g., `*.internal.corp.com