ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt targets the presence of known AdaptixC2 indicators of compromise, which are frequently used by adversaries to establish covert command-and-control channels for data exfiltration and remote execution. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints or network traffic before the adversary can fully leverage the C2 infrastructure to escalate privileges or move laterally within the environment.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`45[.]128[.]156[.]112:56565`	botnet_cc	2026-09-25	75%
ip:port	`160[.]250[.]5[.]251:4321`	botnet_cc	2026-09-25	75%
ip:port	`139[.]180[.]213[.]153:8080`	botnet_cc	2026-09-25	100%
ip:port	`139[.]180[.]213[.]153:80`	botnet_cc	2026-09-25	100%
ip:port	`139[.]180[.]213[.]153:443`	botnet_cc	2026-09-25	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["160.250.5.251", "139.180.213.153", "45.128.156.112"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["160.250.5.251", "139.180.213.153", "45.128.156.112"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AdaptixC2

False Positive Guidance

Legacy Application Update via Third-Party Installer
- Scenario: A business-critical legacy application (e.g., specialized engineering CAD software or financial reporting tools) uses a custom installer script that downloads and executes a helper binary from a known vendor CDN. If this CDN domain or IP range overlaps with an AdaptixC2 IOC (often seen in compromised or repurposed infrastructure), the execution of the installer or its child process may match the hunt criteria.
- Filter/Exclusion: Exclude execution events where the parent process is a known vendor installer (e.g., msiexec.exe, setup.exe from specific vendor paths like C:\Program Files\VendorName\) and the working directory matches the vendor’s installation folder.
Scheduled Task for Log Rotation or Backup Cleanup
- Scenario: An IT operations team creates a scheduled task (via schtasks or Task Scheduler) to run a PowerShell script that cleans up old log files or archives backup data. If the script invokes a utility (like robocopy or a custom .exe) from a network share or a specific IP that coincidentally matches an AdaptixC2 IOC, the task execution may trigger the rule.
- Filter/Exclusion: Exclude events where the command line contains known administrative verbs (e.g., clean, archive, backup, rotate) and the process path is located in standard system or admin directories (e.g., C:\Windows\System32, C:\AdminTools\), and the parent process is svchost.exe (Task Scheduler service).
Development Team Using Local Proxy or Mock Server
- Scenario: Developers in a QA or DevOps team run local mock servers or API proxies (e.g., using ngrok, localtunnel, or a custom Python/Node.js script