ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt detects adversary activity involving six specific indicators of compromise linked to the AdaptixC2 command and control infrastructure, which adversaries use to maintain persistent access and exfiltrate data from compromised endpoints. A SOC team should proactively search for these IOCs within Azure Sentinel to identify early-stage infections or lateral movement attempts that may evade standard signature-based detections, thereby reducing dwell time before full compromise occurs.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 6 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`88[.]119[.]169[.]216:4321`	botnet_cc	2026-09-01	75%
ip:port	`104[.]207[.]93[.]167:4321`	botnet_cc	2026-09-01	75%
ip:port	`94[.]102[.]49[.]164:80`	botnet_cc	2026-09-01	100%
ip:port	`94[.]102[.]49[.]164:8080`	botnet_cc	2026-09-01	100%
ip:port	`94[.]102[.]49[.]164:8443`	botnet_cc	2026-09-01	100%
ip:port	`94[.]102[.]49[.]164:443`	botnet_cc	2026-09-01	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["94.102.49.164", "88.119.169.216", "104.207.93.167"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["94.102.49.164", "88.119.169.216", "104.207.93.167"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AdaptixC2

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Enterprise Antivirus Engine Updates
- Context: The AdaptixC2 detection logic often flags specific hash values or network connections that match the signature of major endpoint protection suites. In many enterprises, CrowdStrike Falcon or Microsoft Defender for Endpoint performs daily definition updates and telemetry uploads to their cloud gateways using ports and IP ranges that overlap with AdaptixC2 IOCs.
- Suggested Filter/Exclusion: Create a rule exclusion based on the Process Name (FalconSensor.exe, MsMpEng.exe) and exclude traffic destined for known vendor update endpoints (e.g., *.falcon.crowdstrike.com or *.update.microsoft.com).
Scenario: Scheduled Backup Jobs via Cloud Storage
- Context: Automated backup solutions like Veeam Backup & Replication or Rubrik frequently initiate scheduled jobs during off-hours to upload data to cloud repositories (AWS S3, Azure Blob). These agents often utilize specific TLS certificates and connection patterns that mimic the C2 behavior of AdaptixC2, particularly if they use similar port ranges (e.g., 443) and periodic heartbeat intervals.
- Suggested Filter/Exclusion: Exclude alerts where the source process is a known backup agent (VeeamAgent.exe, rubrik-agent) and the destination IP belongs to approved cloud storage CIDR blocks defined in your network topology.
Scenario: IT Admin Remote Management Sessions
- Context: System administrators frequently use remote management tools like Ivanti Neurons, ManageEngine Desktop Central, or Microsoft SCCM (Configuration Manager) to push policies and scan endpoints.