ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt targets adversary command and control activities by identifying network traffic matching eight specific IOCs linked to the AdaptixC2 framework. Proactive detection within Azure Sentinel is critical to rapidly isolate potential compromises before attackers can establish persistent footholds or exfiltrate sensitive data using these known indicators.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 8 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`93[.]115[.]172[.]235:7579`	botnet_cc	2026-07-10	75%
ip:port	`144[.]31[.]117[.]38:47825`	botnet_cc	2026-07-10	75%
ip:port	`202[.]1[.]31[.]83:8080`	botnet_cc	2026-07-10	100%
ip:port	`202[.]1[.]31[.]83:80`	botnet_cc	2026-07-10	100%
ip:port	`202[.]1[.]31[.]83:443`	botnet_cc	2026-07-10	100%
ip:port	`156[.]244[.]11[.]247:8080`	botnet_cc	2026-07-10	100%
ip:port	`156[.]244[.]11[.]247:80`	botnet_cc	2026-07-10	100%
ip:port	`156[.]244[.]11[.]247:443`	botnet_cc	2026-07-10	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["156.244.11.247", "144.31.117.38", "202.1.31.83", "93.115.172.235"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["156.244.11.247", "144.31.117.38", "202.1.31.83", "93.115.172.235"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AdaptixC2

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule, tailored for an enterprise environment:

Endpoint Protection Scanning of Quarantine Archives
- Scenario: The organization’s Endpoint Detection and Response (EDR) solution, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs a scheduled deep scan of the quarantine folder. This process extracts archived malware samples (including historical AdaptixC2 variants stored in .zip or .7z containers) into memory for heuristic analysis, triggering network connections to the IOCs embedded within those archives without actual infection.
- Suggested Filter: Exclude traffic originating from specific EDR service accounts (e.g., svc-crowdstrike, MDE-Service) connecting to the IOC IP/URLs when the source process is identified as the scanner executable (C:\Program Files\CrowdStrike\fs.exe or MsMpEng.exe).
Security Information and Event Management (SIEM) Enrichment Jobs
- Scenario: A scheduled nightly job within the SIEM platform, such as Splunk Enterprise Security or IBM QRadar, executes an external lookup task to enrich threat intelligence feeds. The system queries public ThreatFox APIs or internal DNS resolvers to validate the current status of AdaptixC2 indicators (IP reputation and domain age), generating legitimate outbound connections that mimic active command-and-control traffic.
- Suggested Filter: Create a whitelist for the SIEM’s management server IP addresses and restrict the rule trigger to exclude connections where the destination port is standard HTTP/HTTPS (80/443) initiated by known SIEM service processes (e.g., splunkd.exe, qradar_agent).
Software Supply Chain Integrity Verification
- Scenario: The DevOps