ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt targets adversary activity involving known AdaptixC2 command-and-control infrastructure by correlating network traffic against a specific set of 14 Indicators of Compromise. Proactively hunting for these IOCs in Azure Sentinel is critical to identify early-stage lateral movement or data exfiltration attempts before they escalate into full-blown incidents within the cloud environment.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 14 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`45[.]136[.]13[.]247:8888`	botnet_cc	2026-07-19	100%
ip:port	`154[.]219[.]115[.]123:60002`	botnet_cc	2026-07-19	100%
ip:port	`45[.]136[.]13[.]247:8443`	botnet_cc	2026-07-19	100%
ip:port	`38[.]242[.]212[.]5:80`	botnet_cc	2026-07-19	100%
ip:port	`38[.]242[.]212[.]5:8080`	botnet_cc	2026-07-19	100%
ip:port	`38[.]242[.]212[.]5:443`	botnet_cc	2026-07-19	100%
ip:port	`38[.]242[.]212[.]5:1390`	botnet_cc	2026-07-19	100%
ip:port	`154[.]219[.]115[.]123:80`	botnet_cc	2026-07-19	100%
ip:port	`1[.]92[.]135[.]168:443`	botnet_cc	2026-07-19	100%
ip:port	`178[.]105[.]144[.]206:4321`	botnet_cc	2026-07-19	75%
ip:port	`1[.]92[.]135[.]168:8080`	botnet_cc	2026-07-19	100%
ip:port	`154[.]219[.]115[.]123:8080`	botnet_cc	2026-07-19	100%
ip:port	`154[.]219[.]115[.]123:443`	botnet_cc	2026-07-19	100%
ip:port	`45[.]77[.]89[.]29:9000`	botnet_cc	2026-07-19	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["38.242.212.5", "45.136.13.247", "154.219.115.123", "178.105.144.206", "45.77.89.29", "1.92.135.168"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["38.242.212.5", "45.136.13.247", "154.219.115.123", "178.105.144.206", "45.77.89.29", "1.92.135.168"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AdaptixC2

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule, tailored for an enterprise environment:

Endpoint Protection Policy Updates via Microsoft Defender for Endpoint
- Scenario: The security team pushes a new definition update or policy configuration to all endpoints. This process triggers network connections from the local Microsoft Defender Antivirus service to known AdaptixC2 infrastructure IPs (often used by third-party threat intelligence feeds integrated into Defender) to validate signatures before deployment.
- Filter/Exclusion: Create an exclusion for traffic originating from the specific hostnames or Service Accounts associated with the MDE management console (e.g., MDE-Admin-SVC) connecting to the AdaptixC2 IP range during standard maintenance windows (e.g., 01:00–04:00 UTC).
Scheduled Enterprise Backup Jobs using Veeam or Commvault
- Scenario: A nightly backup job configured in Veeam Backup & Replication initiates a connection to an off-site repository. The backup server’s network stack resolves DNS queries and establishes handshakes with AdaptixC2 nodes that act as part of the organization’s broader threat intelligence exchange or secure gateway, generating traffic matching the C2 beacon pattern.
- Filter/Exclusion: Exclude connections where the source process is VeeamAgent.exe (or vbrservice) and the destination port matches the specific AdaptixC2 beacon ports, provided the connection duration exceeds 30 seconds (indicating a bulk data transfer rather than a short C2 heartbeat).
Patch Management Deployments via SCCM or Intune
- Scenario: During a scheduled Microsoft Endpoint Configuration Manager (SCCM) deployment cycle, the WUAuserv service on client machines queries external repositories to download critical security patches.