ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt detects adversary activity involving four specific indicators of compromise (IOCs) linked to the AdaptixC2 command and control infrastructure, which are often used by threat actors to establish persistent communication channels within compromised networks. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification of AdaptixC2 traffic allows the SOC team to isolate affected endpoints before adversaries can exfiltrate sensitive data or execute lateral movement attacks.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`195[.]242[.]119[.]228:8080`	botnet_cc	2026-08-06	100%
ip:port	`195[.]242[.]119[.]228:443`	botnet_cc	2026-08-06	100%
ip:port	`134[.]122[.]132[.]28:4321`	botnet_cc	2026-08-06	75%
ip:port	`195[.]242[.]119[.]228:80`	botnet_cc	2026-08-06	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["134.122.132.28", "195.242.119.228"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["134.122.132.28", "195.242.119.228"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AdaptixC2

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Enterprise Backup Software Communication
- Context: Legitimate backup agents (e.g., Veeam, Commvault, or Rubrik) often maintain persistent connections to cloud management portals or update servers that share IP ranges or domain hashes with AdaptixC2 infrastructure. These agents may periodically query the specific IOCs defined in the rule during their scheduled maintenance windows.
- Suggested Filter/Exclusion: Exclude traffic where the source process is a known backup executable (e.g., Veeam.Backup.Service.exe, commvault.cmd) and the destination port matches standard HTTPS (443) or specific backup ports, provided the connection occurs during defined maintenance windows (e.g., 02:00–06:00 local time).
Scenario: Endpoint Protection Management Console
- Context: Security suites like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne utilize a centralized management console. If the AdaptixC2 IOCs include domains used by the vendor’s update servers or telemetry endpoints, the endpoint agents will generate alerts when polling for policy updates or threat intelligence feeds.
- Suggested Filter/Exclusion: Create an exclusion rule based on the Process Name and Parent Process. If the initiating process is the primary security agent (e.g., FalconSensor.exe, MsMpEng.exe) communicating with a known vendor update domain, suppress the alert. Additionally, whitelist specific IP ranges associated with the endpoint provider’s cloud infrastructure.
Scenario: Scheduled PowerShell or Scripted Admin Tasks
- Context: IT administrators often run scheduled tasks (via Task Scheduler) that utilize PowerShell scripts to fetch external threat intelligence feeds or