ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt detects adversary activity involving four specific Indicators of Compromise (IOCs) linked to the AdaptixC2 command and control infrastructure, which are often utilized by threat actors for persistent communication with compromised hosts. Proactively hunting for these IOCs within Azure Sentinel is critical because early identification of AdaptixC2 traffic can reveal stealthy lateral movement or data exfiltration attempts before they escalate into a full-scale incident.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`207[.]56[.]26[.]118:4321`	botnet_cc	2026-08-14	75%
ip:port	`207[.]56[.]26[.]121:4321`	botnet_cc	2026-08-14	75%
ip:port	`117[.]24[.]4[.]112:3333`	botnet_cc	2026-08-14	75%
ip:port	`103[.]51[.]145[.]75:4321`	botnet_cc	2026-08-14	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["103.51.145.75", "117.24.4.112", "207.56.26.118", "207.56.26.121"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["103.51.145.75", "117.24.4.112", "207.56.26.118", "207.56.26.121"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AdaptixC2

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule, including targeted filters and exclusions:

Scenario: Scheduled Antivirus Definition Updates
- Context: The enterprise’s endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender) performs nightly definition updates. These updates often download signature files from cloud repositories that share hash values or domain patterns with known AdaptixC2 IOCs, particularly if the vendor uses a shared CDN for distribution.
- Filter/Exclusion: Create an exclusion rule for processes named falcon.sys (CrowdStrike) or MsMpEng.exe (Defender) when they initiate network connections to specific update domains (e.g., *.crowdstrike.com, *.microsoft.com). Additionally, exclude traffic occurring strictly between 02:00 and 04:00 UTC on weekdays.
Scenario: Third-Party Patch Management Execution
- Context: The IT operations team utilizes Ivanti Neurons or ManageEngine Desktop Central to deploy OS patches. During the patching window, these tools download large payloads from public repositories that may contain artifacts matching AdaptixC2 file hashes or network signatures used for command-and-control communication.
- Filter/Exclusion: Exclude alerts generated by the specific service accounts running the patch management agents (e.g., svc-patch-mgmt or IvantiService). Configure a filter to suppress detections where the source process path is located within the C:\Program Files\Ivanti\ directory.
Scenario: Automated Cloud Backup Jobs
- Context: The organization runs daily incremental backups using Veeam Backup & Replication. The backup agent communicates with the cloud repository to verify integrity, generating network traffic and file hashes