ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hypothesis targets the presence of known AdaptixC2 indicators of compromise, which are frequently used by adversaries to establish persistent command-and-control channels for data exfiltration and remote execution. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised assets early, preventing the AdaptixC2 framework from facilitating lateral movement or further post-exploitation activities within the environment.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 6 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`64[.]225[.]28[.]168:4321`	botnet_cc	2026-09-28	50%
ip:port	`23[.]158[.]24[.]123:4321`	botnet_cc	2026-09-28	50%
ip:port	`181[.]41[.]201[.]103:4321`	botnet_cc	2026-09-28	50%
ip:port	`119[.]45[.]93[.]117:4321`	botnet_cc	2026-09-28	50%
ip:port	`119[.]45[.]105[.]71:4321`	botnet_cc	2026-09-28	50%
ip:port	`178[.]16[.]52[.]239:8091`	botnet_cc	2026-09-28	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["178.16.52.239", "119.45.105.71", "181.41.201.103", "23.158.24.123", "119.45.93.117", "64.225.28.168"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["178.16.52.239", "119.45.105.71", "181.41.201.103", "23.158.24.123", "119.45.93.117", "64.225.28.168"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AdaptixC2

False Positive Guidance

Legacy Application Whitelisting: A legacy line-of-business application (e.g., an older version of SAP GUI or a custom Java-based reporting tool) may use a specific hash or file path that matches one of the AdaptixC2 IOCs due to outdated build artifacts or shared libraries.
- Filter/Exclusion: Exclude known legacy application directories (e.g., C:\Program Files\LegacyApp\) or specific executable names (e.g., legacy_app.exe) from the IOC match if the process is signed by a trusted vendor and resides in a standard installation path.
Software Development Kits (SDKs) and Build Tools: Developers using specific C/C++ or .NET SDKs might compile or link against libraries that share a common hash or filename with the AdaptixC2 payload, particularly if the SDK includes pre-compiled binaries for testing or demo purposes.
- Filter/Exclusion: Exclude processes originating from standard development directories (e.g., C:\Program Files\Microsoft Visual Studio\, C:\Users\<User>\.nuget\packages\) or those launched by known build tools (e.g., msbuild.exe, dotnet.exe, gcc.exe).
Scheduled Maintenance Jobs: IT operations teams may deploy scheduled tasks (via Task Scheduler or cron on Linux) that execute a utility script or binary with a generic name (e.g., update_check.exe or sync_data.sh) that coincidentally matches an IOC filename or hash used by the AdaptixC2 implant for persistence.
- Filter/Exclusion: Exclude processes where the parent process is svchost.exe (Windows) or systemd/cron (Linux) and the execution path is within a standard system or admin directory (e.g., C:\Windows\System32\, /usr/local/bin/), provided the user