ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt detects adversary activity involving eight specific indicators of compromise (IOCs) linked to the AdaptixC2 command and control infrastructure. Proactively searching for these signals in Azure Sentinel is critical because early identification of AdaptixC2 traffic can reveal active lateral movement or data exfiltration attempts before they escalate into a full-scale incident.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 8 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`194[.]182[.]87[.]116:443`	botnet_cc	2026-08-18	100%
ip:port	`194[.]182[.]87[.]116:4433`	botnet_cc	2026-08-18	100%
ip:port	`68[.]178[.]202[.]150:4321`	botnet_cc	2026-08-18	75%
ip:port	`68[.]178[.]205[.]17:4321`	botnet_cc	2026-08-18	75%
ip:port	`20[.]51[.]121[.]37:4321`	botnet_cc	2026-08-18	75%
ip:port	`195[.]242[.]119[.]228:4321`	botnet_cc	2026-08-18	75%
ip:port	`192[.]169[.]176[.]54:4321`	botnet_cc	2026-08-18	75%
ip:port	`185[.]193[.]127[.]4:13370`	botnet_cc	2026-08-18	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["20.51.121.37", "195.242.119.228", "68.178.205.17", "194.182.87.116", "68.178.202.150", "192.169.176.54", "185.193.127.4"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["20.51.121.37", "195.242.119.228", "68.178.205.17", "194.182.87.116", "68.178.202.150", "192.169.176.54", "185.193.127.4"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AdaptixC2

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: AdaptixC2 IOCs detection rule in an enterprise environment:

Scenario: Legitimate Cloud Backup Synchronization
- Context: Enterprise backup solutions (e.g., Veeam, Rubrik, or Azure Backup) often utilize specific hash algorithms and communication patterns that overlap with AdaptixC2 IOCs. When the backup agent connects to the central management server, it may generate network traffic matching the rule’s signature for command-and-control (C2) beacons.
- Filter/Exclusion: Exclude traffic originating from the VeeamBackupService or AzureBackupAgent processes where the destination IP belongs to the internal backup infrastructure subnet (e.g., 10.50.x.x). Additionally, filter out events where the User-Agent string contains “Veeam” or “Rubrik”.
Scenario: Scheduled Antivirus Definition Updates
- Context: Endpoint protection platforms like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint perform scheduled definition updates. These agents often download large signature files from update servers that share similar TLS fingerprint characteristics with the AdaptixC2 IOCs, triggering a false C2 alert during the nightly maintenance window (e.g., 02:00 – 04:00 UTC).
- Filter/Exclusion: Create an exclusion for events occurring between 02:00 and 04:00 on weekdays where the source process name is one of the known AV agents (e.g., FalconSensor.exe, S1Agent.exe). Further refine by excluding connections to known update server domains such as *.crowdstrike.com or *.sentinelone.net.
Scenario: Internal Patch Management Deployment *