ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt targets the presence of AdaptixC2 command-and-control infrastructure by correlating known ThreatFox IOCs with network traffic and endpoint telemetry. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised assets leveraging this specific C2 framework before adversaries can establish persistent access or execute lateral movement.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`178[.]94[.]25[.]230:8902`	botnet_cc	2026-09-22	75%
ip:port	`172[.]252[.]225[.]151:12688`	botnet_cc	2026-09-22	75%
ip:port	`172[.]252[.]225[.]152:12688`	botnet_cc	2026-09-22	75%
ip:port	`172[.]252[.]225[.]153:12688`	botnet_cc	2026-09-22	75%
ip:port	`109[.]74[.]144[.]151:46321`	botnet_cc	2026-09-22	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["109.74.144.151", "172.252.225.153", "172.252.225.152", "172.252.225.151", "178.94.25.230"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["109.74.144.151", "172.252.225.153", "172.252.225.152", "172.252.225.151", "178.94.25.230"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AdaptixC2

False Positive Guidance

Scenario: A DevOps team deploys a new internal monitoring agent or log shipper that reuses a common hash or network endpoint previously seen in the wild for AdaptixC2.
- Filter/Exclusion: Exclude processes originating from the specific deployment directory (e.g., C:\Program Files\InternalMonitoring\) or exclude network connections to the specific internal IP range used by the monitoring cluster.
Scenario: An IT administrator runs a standard Windows Update or third-party patching tool (e.g., WSUS, SCCM, or Ninite) that downloads a component with a file hash matching one of the AdaptixC2 IOCs due to a shared library or common build artifact.
- Filter/Exclusion: Exclude events where the parent process is a known patching service (e.g., wuauclt.exe, ccmexec.exe, or Ninite.exe) and the file path resides in standard system or application update directories.
Scenario: A security team performs a manual threat hunt or validation test by downloading the known AdaptixC2 sample to a jump host or isolated VM to verify detection coverage, triggering the IOC match.
- Filter/Exclusion: Exclude events where the host is tagged as a “Test Environment” or “Jump Host” in the asset inventory, or exclude processes running under a dedicated service account used for threat hunting (e.g., svc_threathunt).
Scenario: A legacy application or custom script uses a generic HTTP client library or shared DLL that has a known hash collision with one of the AdaptixC2 IOCs, particularly if the application is not digitally signed or is an older version.
- Filter/Exclusion: Exclude processes where the executable name matches the legacy application (e.g., legacy_app.exe) and the file path is within the application’s install directory