ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt detects adversary activity involving four specific Indicators of Compromise (IOCs) linked to the AdaptixC2 command and control infrastructure, signaling potential lateral movement or data exfiltration attempts. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly identify early-stage infections by this threat actor and mitigate risks before they escalate into broader network compromises.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`121[.]127[.]253[.]146:4444`	botnet_cc	2026-08-30	100%
ip:port	`121[.]127[.]253[.]146:80`	botnet_cc	2026-08-30	100%
ip:port	`121[.]127[.]253[.]146:8080`	botnet_cc	2026-08-30	100%
ip:port	`121[.]127[.]253[.]146:443`	botnet_cc	2026-08-30	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["121.127.253.146"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["121.127.253.146"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AdaptixC2

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: AdaptixC2 IOCs detection rule in an enterprise environment:

Scenario: Scheduled Backup Jobs Utilizing Known Hashes
- Context: Enterprise backup solutions (e.g., Veeam, Commvault) often run scheduled jobs that generate network traffic or process files with hashes identical to those flagged by the AdaptixC2 IOCs. This is common when backup agents communicate with central servers using standard protocols.
- Suggested Filter/Exclusion: Exclude processes running under specific service accounts (e.g., DOMAIN\BackupSvc) and restrict the rule to exclude traffic originating from known backup subnets or specific hostnames containing “Backup” in their name.
Scenario: Endpoint Protection Scanning by Security Agents
- Context: Next-generation antivirus solutions like Microsoft Defender for Endpoint, CrowdStrike Falcon, or Symantec Endpoint Protection frequently download definition updates or scan artifacts that match the AdaptixC2 signature patterns. The detection logic may trigger when these agents perform real-time scanning of a specific directory containing the IOC-matching file.
- Suggested Filter/Exclusion: Create an exclusion for processes with executable paths matching standard security vendor directories (e.g., C:\Program Files\Microsoft Defender\, C:\ProgramData\CrowdStrike\) and exclude events where the parent process is a known security agent service.
Scenario: Admin Deployment via Configuration Management Tools
- Context: System administrators often use tools like Microsoft SCCM, Ansible, or Puppet to deploy software patches or configuration scripts across the fleet. If a deployment package contains a utility or script that matches one of the AdaptixC2 IOCs (e.g., a specific DLL or EXE hash), the rule will trigger during routine maintenance windows.
- **Suggested Filter