ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the AdaptixC2 command and control infrastructure by monitoring network traffic against five specific Indicators of Compromise (IOCs). A SOC team should proactively search for these signals in Azure Sentinel to rapidly identify early-stage infections or lateral movement attempts that may evade standard signature-based detections.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`144[.]172[.]117[.]108:4321`	botnet_cc	2026-08-29	75%
ip:port	`103[.]116[.]52[.]203:4321`	botnet_cc	2026-08-29	75%
ip:port	`20[.]119[.]73[.]195:80`	botnet_cc	2026-08-29	100%
ip:port	`20[.]119[.]73[.]195:8080`	botnet_cc	2026-08-29	100%
ip:port	`20[.]119[.]73[.]195:443`	botnet_cc	2026-08-29	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["144.172.117.108", "103.116.52.203", "20.119.73.195"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["144.172.117.108", "103.116.52.203", "20.119.73.195"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AdaptixC2

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: AdaptixC2 IOCs detection rule in an enterprise environment:

Scenario: Enterprise Endpoint Protection Scans
- Context: The primary security suite (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon, or SentinelOne) performs scheduled signature updates and heuristic scans. These tools often communicate with cloud update servers that share IP ranges or domain patterns similar to the AdaptixC2 IOCs.
- Filter/Exclusion: Create a rule exclusion based on the ProcessName of the security agent (e.g., MsMpEng.exe, FalconSensorService.exe) and exclude traffic originating from specific internal update server subnets (e.g., 10.20.x.x).
Scenario: Automated Patching and Configuration Management
- Context: Scheduled jobs managed by tools like SCCM (System Center Configuration Manager), Ansible, or Puppet initiate outbound connections to download patches or configuration manifests. These management servers often utilize shared CDN endpoints that may overlap with the AdaptixC2 detection logic.
- Filter/Exclusion: Exclude alerts where the InitiatingUser is a known service account (e.g., DOMAIN\SCCM_Service_Acc) and the process path matches the standard installation directory of the patching tool (e.g., C:\Program Files\Microsoft Configuration Manager\).
Scenario: Cloud Backup and Data Replication Services
- Context: Background services from backup solutions like Veeam, Rubrik, or Azure Backup establish persistent connections to cloud storage gateways. These gateways often utilize IP addresses that fall within the same CIDR blocks monitored by the AdaptixC2 rule.
- Filter/Exclusion: Implement a filter excluding traffic where the DestinationPort matches standard backup ports (