Adversaries using AdaptixC2 are likely establishing command and control communication through suspicious network connections and file executions. SOC teams should proactively hunt for these IOCs in Azure Sentinel to identify and mitigate potential compromise from advanced persistent threats.
IOC Summary
Malware Family: AdaptixC2 Total IOCs: 3 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 194[.]163[.]175[.]135:8679 | botnet_cc | 2026-05-11 | 75% |
| ip:port | 185[.]242[.]245[.]27:44875 | botnet_cc | 2026-05-11 | 75% |
| ip:port | 172[.]239[.]57[.]52:1234 | botnet_cc | 2026-05-11 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["185.242.245.27", "172.239.57.52", "194.163.175.135"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["185.242.245.27", "172.239.57.52", "194.163.175.135"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: Legitimate scheduled job using hunting tool for threat intelligence enrichment
Filter/Exclusion: process.name != "hunting"
Scenario: System administrator using PowerShell to run a script that queries ThreatFox for known malicious domains
Filter/Exclusion: process.name != "powershell.exe" or process.args !~ "ThreatFox"
Scenario: Security team using Splunk to query ThreatFox for IOC analysis during an incident response
Filter/Exclusion: process.name != "splunkd" or process.args !~ "ThreatFox"
Scenario: IT staff running a script with curl to fetch threat intelligence data from ThreatFox as part of a security tooling pipeline
Filter/Exclusion: process.name != "curl" or process.args !~ "ThreatFox"
Scenario: Regular use of Windows Task Scheduler to run a script that checks for known malicious domains via ThreatFox API
Filter/Exclusion: process.name != "schtasks.exe" or process.args !~ "ThreatFox"