ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt seeks to identify adversary activity where malicious hosts establish encrypted connections with AdaptixC2 infrastructure to facilitate persistent command-and-control communication and data exfiltration. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early detection of this malware family can prevent long-term compromise by revealing hidden lateral movement before significant data loss occurs.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 57 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`38[.]54[.]63[.]135:8080`	botnet_cc	2026-07-17	100%
ip:port	`38[.]54[.]63[.]135:443`	botnet_cc	2026-07-17	100%
ip:port	`38[.]54[.]63[.]135:80`	botnet_cc	2026-07-17	100%
ip:port	`23[.]227[.]203[.]191:10443`	botnet_cc	2026-07-17	100%
ip:port	`38[.]132[.]122[.]145:6579`	botnet_cc	2026-07-17	100%
ip:port	`38[.]132[.]122[.]145:14888`	botnet_cc	2026-07-17	100%
ip:port	`38[.]132[.]122[.]141:6579`	botnet_cc	2026-07-17	100%
ip:port	`23[.]227[.]203[.]191:6579`	botnet_cc	2026-07-17	100%
ip:port	`217[.]60[.]97[.]3:8080`	botnet_cc	2026-07-17	100%
ip:port	`38[.]132[.]122[.]161:6579`	botnet_cc	2026-07-17	100%
ip:port	`23[.]227[.]203[.]128:6579`	botnet_cc	2026-07-17	100%
ip:port	`23[.]227[.]203[.]190:14888`	botnet_cc	2026-07-17	100%
ip:port	`23[.]227[.]203[.]190:6579`	botnet_cc	2026-07-17	100%
ip:port	`217[.]60[.]97[.]3:80`	botnet_cc	2026-07-17	100%
ip:port	`217[.]60[.]97[.]3:443`	botnet_cc	2026-07-17	100%
ip:port	`217[.]60[.]97[.]3:9200`	botnet_cc	2026-07-17	100%
ip:port	`23[.]227[.]203[.]205:6579`	botnet_cc	2026-07-17	100%
ip:port	`23[.]227[.]203[.]246:6579`	botnet_cc	2026-07-17	100%
ip:port	`79[.]135[.]160[.]20:8080`	botnet_cc	2026-07-17	100%
ip:port	`85[.]158[.]57[.]247:8080`	botnet_cc	2026-07-17	100%
ip:port	`23[.]227[.]203[.]71:8080`	botnet_cc	2026-07-17	100%
ip:port	`23[.]227[.]203[.]71:443`	botnet_cc	2026-07-17	100%
ip:port	`23[.]227[.]203[.]71:80`	botnet_cc	2026-07-17	100%
ip:port	`79[.]135[.]160[.]20:443`	botnet_cc	2026-07-17	100%
ip:port	`79[.]135[.]160[.]20:80`	botnet_cc	2026-07-17	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["217.148.142.28", "38.132.122.145", "23.227.203.190", "45.77.89.29", "23.227.203.246", "79.135.160.20", "38.132.122.141", "45.136.13.247", "177.153.202.224", "23.227.203.191", "23.227.203.205", "38.132.122.161", "2.26.229.254", "38.54.63.135", "217.60.97.3", "154.19.229.197", "154.19.229.186", "154.19.229.85", "23.227.203.71", "23.227.203.128", "46.21.153.148", "85.158.57.247", "46.21.153.146", "23.227.199.61"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["217.148.142.28", "38.132.122.145", "23.227.203.190", "45.77.89.29", "23.227.203.246", "79.135.160.20", "38.132.122.141", "45.136.13.247", "177.153.202.224", "23.227.203.191", "23.227.203.205", "38.132.122.161", "2.26.229.254", "38.54.63.135", "217.60.97.3", "154.19.229.197", "154.19.229.186", "154.19.229.85", "23.227.203.71", "23.227.203.128", "46.21.153.148", "85.158.57.247", "46.21.153.146", "23.227.199.61"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AdaptixC2

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Patch Management and Software Deployment Scans
- Scenario: Enterprise patch management tools like Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ivanti Neurons frequently initiate outbound connections to vendor update servers. If the AdaptixC2 IOCs include IP ranges used by major software vendors (e.g., Microsoft Update, Adobe, or specific SaaS providers), these routine health checks and patch downloads will trigger the rule as potential C2 communication.
- Filter/Exclusion: Create a whitelist exclusion for traffic originating from known management server subnets (e.g., 10.50.10.0/24 for SCCM) communicating with specific vendor IP ranges identified in the IOC list, or exclude the specific process names (ccmexec.exe, IvantiAgent.exe) during standard maintenance windows.
Cloud Backup and Data Synchronization Agents
- Scenario: Scheduled backup jobs running on workstations and servers using tools like Veeam Agent, Acronis Cyber Protect, or Microsoft Azure Arc often establish persistent, encrypted connections to cloud storage endpoints for data exfiltration. The “data exfiltration” aspect of the AdaptixC2 logic may misinterpret these large, scheduled upload sessions as malicious C2 traffic, especially if the backup vendor’s IP addresses overlap with the IOC list.
- Filter/Exclusion: Exclude traffic from backup service processes (e.g., VeeamAgent.exe, AcronisService.exe) connecting to known cloud storage CIDR blocks (e.g., AWS S3, Azure Blob Storage) during defined backup schedules (e.g., 02:00–0