This hunt detects adversary activity involving three specific Indicators of Compromise (IOCs) linked to the AdaptixC2 command-and-control infrastructure, which adversaries leverage for persistent communication and data exfiltration. A proactive search is essential within Azure Sentinel because early identification of these IOCs enables rapid containment of potential lateral movement before the threat actor establishes a foothold in the environment.
Malware Family: AdaptixC2 Total IOCs: 3 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 91[.]92[.]34[.]73:43283 | botnet_cc | 2026-08-10 | 75% |
| ip:port | 31[.]77[.]195[.]32:4321 | botnet_cc | 2026-08-10 | 75% |
| ip:port | 149[.]28[.]37[.]137:8080 | botnet_cc | 2026-08-10 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["91.92.34.73", "149.28.37.137", "31.77.195.32"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["91.92.34.73", "149.28.37.137", "31.77.195.32"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are the false positive scenarios and corresponding filters for the ThreatFox: AdaptixC2 IOCs detection rule:
Scenario: The Security Operations Center (SOC) team runs a manual threat intelligence feed update using CrowdStrike Falcon Intelligence or Tenable.io, which pulls in global IOC lists containing overlapping hashes for known benign software often flagged by the AdaptixC2 campaign.
falcon-sensor.exe (CrowdStrike) or tenable-agent.exe and the event type is “Threat Intelligence Update” during scheduled maintenance windows (e.g., 02:00–04:00 UTC).Scenario: A scheduled PowerShell job named “Enterprise Patch Compliance Check” executes nightly on domain controllers, querying external reputation services that inadvertently match the AdaptixC2 network signatures due to shared certificate authorities or common API endpoints.
Microsoft\Windows\UpdateOrchestrator or PowerShell scripts running as SYSTEM account on servers with the OU path containing \Domain Controllers, provided the destination IP is within the internal corporate subnet (e.g., 10.0.x.x).Scenario: The IT Operations team deploys a new version of the endpoint protection agent via Microsoft SCCM (Configuration Manager), which triggers network connections to update servers that share specific IOCs with the AdaptixC2 command and control infrastructure.
ccmsetup.exe or wuauserv.exe and the destination port matches standard software update ports (443, 80), specifically when the source machine belongs to the “Patch Management” collection group.