ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt detects adversary command and control activities linked to the AdaptixC2 framework by identifying network traffic matching nine specific indicators of compromise. Proactively searching for these signatures in Azure Sentinel is critical to rapidly identify early-stage lateral movement or data exfiltration attempts before they escalate into significant security incidents.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 9 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`144[.]31[.]117[.]38:80`	botnet_cc	2026-07-11	100%
ip:port	`82[.]158[.]229[.]189:18443`	botnet_cc	2026-07-11	75%
ip:port	`82[.]158[.]229[.]30:18443`	botnet_cc	2026-07-11	75%
ip:port	`82[.]158[.]229[.]143:18443`	botnet_cc	2026-07-11	75%
ip:port	`31[.]207[.]4[.]197:9872`	botnet_cc	2026-07-11	75%
ip:port	`178[.]104[.]249[.]136:4321`	botnet_cc	2026-07-11	75%
ip:port	`1[.]14[.]234[.]68:4321`	botnet_cc	2026-07-11	75%
ip:port	`144[.]31[.]117[.]38:8080`	botnet_cc	2026-07-11	100%
ip:port	`144[.]31[.]117[.]38:443`	botnet_cc	2026-07-11	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["82.158.229.30", "82.158.229.143", "144.31.117.38", "178.104.249.136", "31.207.4.197", "1.14.234.68", "82.158.229.189"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["82.158.229.30", "82.158.229.143", "144.31.117.38", "178.104.249.136", "31.207.4.197", "1.14.234.68", "82.158.229.189"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — AdaptixC2

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Endpoint Protection Scanning of Quarantine Archives
- Scenario: Enterprise Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, periodically scan large quarantine folders containing historical threat samples. If the AdaptixC2 IOCs include known benign file hashes or URLs previously flagged by the vendor but not yet fully whitelisted in the SIEM, the scanning process may trigger alerts when these agents access or hash-check files within the C:\ProgramData\ThreatQuarantine directory.
- Suggested Filter: Exclude events where the Process Name is the EDR service (e.g., csagent.exe, MsMpEng.exe) and the Target Path contains “Quarantine” or “Archive,” provided the file creation date is older than 30 days.
Scheduled Software Update Deployments via SCCM/Intune
- Scenario: During monthly maintenance windows, Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune pushes updates to third-party applications that utilize AdaptixC2-related libraries or connectors. For instance, a scheduled task named Update_Adaptix_Client running under the SYSTEM account may download configuration manifests from an internal update server hosting these IOCs, triggering network connection alerts on standard ports (80/443) to known IP ranges associated with the rule’s IOCs.
- Suggested Filter: Create a suppression rule for traffic originating from the SCCM Management Point or Intune Update Ring subnets, specifically targeting the Update_Adaptix_Client scheduled task and limiting alerts to business hours (e.g., 02