This hunt detects adversary command and control (C2) communications utilizing specific AdaptixC2 indicators of compromise to identify potential lateral movement or data exfiltration attempts. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification of this C2 infrastructure allows the SOC team to isolate affected assets before the adversary establishes a persistent foothold within the network.
Malware Family: AdaptixC2 Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 45[.]142[.]141[.]139:80 | botnet_cc | 2026-07-21 | 75% |
| ip:port | 185[.]33[.]86[.]141:29292 | botnet_cc | 2026-07-21 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["45.142.141.139", "185.33.86.141"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.142.141.139", "185.33.86.141"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule in an enterprise environment, including suggested filters and exclusions:
Enterprise Endpoint Management Scans: Legitimate network scans performed by tools like Microsoft Defender for Endpoint, CrowdStrike Falcon, or Tenable Nessus may query external threat intelligence feeds that overlap with AdaptixC2 IOCs. These scanners often initiate outbound connections to known IP ranges or domains associated with C2 infrastructure for reputation checking.
svc-crowdstrike, ntservice-defender) and restrict the rule to exclude ports commonly used for management traffic (e.g., 443, 80) when the destination is a known public CDN or cloud provider IP range.Scheduled Software Update Jobs: Automated patch management solutions such as WSUS (Windows Server Update Services), Ivanti, or Ansible playbooks often download updates from repositories that host AdaptixC2 signatures or utilize shared infrastructure IPs. A scheduled job running on a domain controller or build server might trigger the rule during its nightly update window.
DC-PATCH-01, BUILD-SRV-02) and limit the alert scope to specific time windows (e.g., 02:00 – 04:00 local time) when these scheduled jobs are active.Third-Party SIEM or SOAR Integration: Security orchestration platforms like Splunk, IBM QRadar, or Tenable.io frequently pull threat intelligence data from external sources to enrich logs. If the organization subscribes to a feed that includes AdaptixC2 indicators,