ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This detection identifies adversary activity linked to the AdaptixC2 command and control infrastructure by monitoring for specific threat intelligence indicators within Azure Sentinel logs. Proactively hunting for these signals allows the SOC team to rapidly detect early-stage lateral movements or data exfiltration attempts before they escalate into full-scale breaches.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 3 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`2[.]26[.]26[.]153:43216`	botnet_cc	2026-07-27	75%
ip:port	`194[.]233[.]80[.]96:4321`	botnet_cc	2026-07-27	75%
ip:port	`130[.]12[.]182[.]184:1339`	botnet_cc	2026-07-27	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["130.12.182.184", "194.233.80.96", "2.26.26.153"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["130.12.182.184", "194.233.80.96", "2.26.26.153"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AdaptixC2

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule, along with targeted filters and exclusions to refine the alerting logic in an enterprise environment.

Scenario: Automated Patch Deployment via SCCM/Intune
- Context: The Enterprise Configuration Management tool (e.g., Microsoft Endpoint Manager or System Center Configuration Manager) pushes a scheduled update package containing a legitimate utility that matches one of the AdaptixC2 IOCs (often a shared DLL or helper executable). This triggers during nightly maintenance windows.
- Filter/Exclusion: Create an exclusion based on the Process Parent Name and Time Window. Exclude alerts where Parent_Process_Name is “ccmexec.exe” (SCCM) or “Microsoft.IntuneManagementAgent” AND the event timestamp falls between 01:00 and 05:00 UTC.
Scenario: Third-Party Backup Agent Communication
- Context: A legacy backup solution (e.g., Veeam Backup & Replication or Commvault) utilizes a specific network library component that shares an IOCs hash with the AdaptixC2 campaign. The agent initiates outbound connections to cloud storage endpoints, mimicking C2 traffic patterns.
- Filter/Exclusion: Implement a rule exclusion based on Process Path and Destination IP. Exclude events where File_Path matches C:\Program Files\Veeam\BackupAndReplication\Agent\* or C:\Commvault\ContentStore\*, regardless of the specific IOC hash match.
Scenario: Scheduled PowerShell Script for Asset Inventory
- Context: The IT Operations team runs a recurring scheduled task (e.g., “Daily_Asset_Inventory.ps1”) that invokes a remote management script to query hardware details. This script loads a specific