ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This detection identifies adversary activity involving known AdaptixC2 command and control infrastructure by monitoring for specific Indicators of Compromise (IOCs) within network traffic and endpoint logs. A proactive hunt is essential in Azure Sentinel to rapidly uncover early-stage lateral movement or data exfiltration attempts, enabling the SOC team to isolate affected assets before the threat escalates.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 2 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`176[.]126[.]245[.]210:8080`	botnet_cc	2026-07-23	100%
ip:port	`3[.]93[.]175[.]98:8080`	botnet_cc	2026-07-23	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["176.126.245.210", "3.93.175.98"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["176.126.245.210", "3.93.175.98"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AdaptixC2

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusions for the ThreatFox: AdaptixC2 IOCs detection rule in an enterprise environment:

Legitimate Endpoint Management Scans: Managed devices running Microsoft Defender for Endpoint or CrowdStrike Falcon often perform scheduled network connectivity checks that initiate outbound connections to known cloud management endpoints. If these endpoints share IP ranges or domain suffixes with AdaptixC2 IOCs, the rule triggers during daily health checks.
- Suggested Filter: Exclude traffic originating from specific Service Accounts (e.g., svc-defender-agent) and restrict detection to non-business hours if the scan is known to run at 03:00 AM local time.
Third-Party Software Update Mechanisms: Enterprise-wide deployment tools like Microsoft System Center Configuration Manager (SCCM) or Ivanti Neurons frequently download update manifests from vendor repositories. If a legitimate software vendor utilizes the same CDN infrastructure or IP ranges as AdaptixC2, routine patching cycles will generate matching IOCs.
- Suggested Filter: Create an exclusion based on the Process Name (e.g., ccmsetup.exe, IvantiAgent.exe) and whitelist specific destination ports (e.g., 443) associated with known update servers in the network topology.
Scheduled Backup and Replication Jobs: Automated backup solutions such as Veeam Backup & Recovery or Rubrik often establish persistent connections to cloud storage gateways for incremental data synchronization. These jobs may connect to IP addresses that overlap with AdaptixC2 command-and-control indicators, particularly during nightly window executions.
- Suggested Filter: Implement a rule exclusion based on the Source Host Group (e.g., Backup-Cluster-Nodes) and limit detection to specific time windows (e.g., 01: