ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt detects adversary activity involving five specific indicators of compromise (IOCs) linked to the AdaptixC2 command-and-control infrastructure. Proactive hunting in Azure Sentinel is critical because early identification of these IOCs enables rapid containment of potential lateral movement and data exfiltration before the threat escalates within the environment.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`43[.]198[.]116[.]85:443`	botnet_cc	2026-09-02	100%
ip:port	`85[.]120[.]216[.]8:4321`	botnet_cc	2026-09-02	75%
ip:port	`43[.]198[.]116[.]85:4433`	botnet_cc	2026-09-02	100%
ip:port	`43[.]198[.]116[.]85:80`	botnet_cc	2026-09-02	100%
ip:port	`43[.]198[.]116[.]85:8080`	botnet_cc	2026-09-02	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["43.198.116.85", "85.120.216.8"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["43.198.116.85", "85.120.216.8"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AdaptixC2

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule in an enterprise environment, along with suggested filters and exclusions:

Scenario: Legitimate Endpoint Protection Updates
- Context: The primary security suite (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) initiates a scheduled update cycle that downloads definition files from the vendor’s cloud repository. If the AdaptixC2 rule monitors specific SHA-256 hashes or domain connections used by these vendors, the update traffic may be flagged as C2 activity.
- Filter/Exclusion: Exclude network traffic and process executions originating from the Microsoft Defender Antivirus Service (MsMpEng.exe) or CrowdStrike Falcon Sensor (C-Service.exe) when connecting to known vendor update domains (e.g., *.microsoft.com, *.crowdstrike.com).
Scenario: Scheduled Backup Operations
- Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault run nightly jobs that establish persistent connections to cloud storage buckets. These agents often utilize standard HTTP/HTTPS ports and specific user-agent strings that overlap with the IOCs defined for AdaptixC2, triggering a match during windowed execution times (e.g., 01:00–04:00).
- Filter/Exclusion: Create an exclusion based on process name Veeam.Backup.Service.exe or commvault.cmd and restrict the rule to trigger only outside of defined maintenance windows. Alternatively, whitelist the specific destination IP ranges used by the backup cloud storage provider (e.g., AWS S3 endpoints).
Scenario: Admin-Driven Patching via Configuration Management
- Context: System administrators utilize tools like SCCM (Microsoft Endpoint Configuration Manager) or Ansible to push configuration changes and