ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt targets adversary activity involving known AdaptixC2 command-and-control infrastructure by correlating network traffic against eight specific indicators of compromise. Proactively hunting for these IOCs in Azure Sentinel is critical to rapidly identify and contain early-stage lateral movement or data exfiltration attempts before they escalate into a full-scale incident.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 8 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`15[.]235[.]3[.]224:443`	botnet_cc	2026-07-20	100%
ip:port	`15[.]235[.]3[.]224:80`	botnet_cc	2026-07-20	100%
ip:port	`15[.]235[.]3[.]224:8080`	botnet_cc	2026-07-20	100%
ip:port	`149[.]104[.]28[.]204:443`	botnet_cc	2026-07-20	100%
ip:port	`45[.]77[.]89[.]29:8484`	botnet_cc	2026-07-20	100%
ip:port	`149[.]104[.]28[.]204:80`	botnet_cc	2026-07-20	100%
ip:port	`149[.]104[.]28[.]204:8080`	botnet_cc	2026-07-20	100%
ip:port	`149[.]104[.]28[.]204:9879`	botnet_cc	2026-07-20	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["149.104.28.204", "45.77.89.29", "15.235.3.224"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["149.104.28.204", "45.77.89.29", "15.235.3.224"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AdaptixC2

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Endpoint Protection Management Console Updates
- Scenario: The centralized management server (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) initiates a scheduled policy push or definition update. This process often triggers network connections to the vendor’s cloud endpoints, which may share IP ranges or domain names with the AdaptixC2 IOCs due to shared CDN providers (like Akamai or Cloudflare) overlapping in the threat intelligence feed.
- Filter/Exclusion: Create an exclusion for traffic originating from the specific Endpoint Management Server hostnames or IP subnets, and exclude connections destined for known vendor update domains that match the IOC list but are whitelisted by the security team.
Third-Party Cloud Backup Agents (e.g., Veeam or Commvault)
- Scenario: Scheduled backup jobs running on critical file servers utilize third-party agents to upload metadata and logs to a cloud repository. If the backup solution uses a public API gateway that happens to resolve to an IP address included in the AdaptixC2 IOC list (often common with generic SaaS infrastructure), the detection logic will flag these routine high-volume data transfers as potential command-and-control activity.
- Filter/Exclusion: Implement a rule to exclude traffic from Service Accounts associated with backup software (e.g., svc-veeam-backup, commvault-agent) and filter out connections where the destination port is standard for backup protocols (e.g., TCP 443, 8080) during defined maintenance windows.
Automated Patch Management Deployments
- Scenario: During a monthly patch cycle, tools like **