ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This detection rule identifies the presence of AdaptixC2 command-and-control infrastructure, which adversaries leverage to stealthily exfiltrate sensitive data from compromised endpoints. SOC teams should proactively hunt for these indicators in Azure Sentinel to rapidly isolate affected systems and prevent potential data breaches before significant information is extracted.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 12 IOC Types: sha256_hash, ip:port, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
ip:port	`74[.]249[.]84[.]175:4321`	botnet_cc	2026-07-25	75%
ip:port	`51[.]107[.]74[.]185:4321`	botnet_cc	2026-07-25	75%
ip:port	`27[.]124[.]20[.]5:4321`	botnet_cc	2026-07-25	75%
ip:port	`27[.]124[.]20[.]6:4321`	botnet_cc	2026-07-25	75%
ip:port	`207[.]57[.]123[.]129:43211`	botnet_cc	2026-07-25	75%
ip:port	`2[.]27[.]28[.]207:42153`	botnet_cc	2026-07-25	75%
ip:port	`2[.]27[.]29[.]171:42216`	botnet_cc	2026-07-25	75%
ip:port	`144[.]172[.]118[.]84:4321`	botnet_cc	2026-07-25	75%
ip:port	`119[.]28[.]212[.]86:44321`	botnet_cc	2026-07-25	75%
md5_hash	`230aa6979b84ef379373d3638c485fca`	payload	2026-07-25	95%
sha256_hash	`551c8108e3691d035b2417c4f1ec3083c5213514c1c65348c5934dfcad53225b`	payload	2026-07-25	95%
sha1_hash	`608ed0cadd68a22468248632b771c73a845fc812`	payload	2026-07-25	95%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["119.28.212.86", "2.27.29.171", "2.27.28.207", "27.124.20.5", "51.107.74.185", "207.57.123.129", "74.249.84.175", "27.124.20.6", "144.172.118.84"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["119.28.212.86", "2.27.29.171", "2.27.28.207", "27.124.20.5", "51.107.74.185", "207.57.123.129", "74.249.84.175", "27.124.20.6", "144.172.118.84"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - AdaptixC2
let malicious_hashes = dynamic(["230aa6979b84ef379373d3638c485fca", "551c8108e3691d035b2417c4f1ec3083c5213514c1c65348c5934dfcad53225b", "608ed0cadd68a22468248632b771c73a845fc812"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceFileEvents`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AdaptixC2

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule, along with suggested filters or exclusions tailored for an enterprise environment:

Scenario: Automated Backup and Exfiltration by Veeam/Commvault
- Context: Enterprise backup agents (e.g., Veeam Backup & Replication, Commvault) frequently initiate high-volume data transfers to external cloud repositories or off-site storage. These processes often utilize specific ports and network patterns that mimic the “data exfiltration” behavior of AdaptixC2, especially when connecting to known SaaS endpoints that share similar IOCs with the malware family.
- Suggested Filter/Exclusion: Create an exclusion rule based on the Process Name (VeeamAgent.exe, CommServe.exe) and Destination IP Range. Exclude traffic originating from these specific backup service accounts where the destination falls within the organization’s approved cloud storage CIDR blocks (e.g., AWS S3 or Azure Blob endpoints).
Scenario: Scheduled Software Updates via Microsoft Endpoint Configuration Manager (SCCM)
- Context: During maintenance windows, SCCM or Intune agents download large update payloads from public content servers. The AdaptixC2 rule may flag the initial handshake and subsequent chunked data transfer as a C2 beacon if the source IP of the update server matches a known AdaptixC2 indicator or uses similar TLS fingerprinting characteristics.
- Suggested Filter/Exclusion: Implement a time-based exclusion for the Process Name (ccmsetup.exe, Microsoft.Update.Service) during defined maintenance windows (e.g., 02:00–04:00 UTC). Additionally, whitelist the specific User-Agent strings associated with Microsoft update traffic to differentiate them from the stealthy C2 tool.
**Scenario: Legitimate Remote