ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt hypothesis detects adversary activity involving the AdaptixC2 command and control infrastructure by monitoring for three specific indicators of compromise within network traffic and endpoint logs. Proactively hunting for these IOCs in Azure Sentinel is critical to identify early-stage lateral movement or data exfiltration attempts before they escalate into a full-blown incident, given the high severity associated with this threat actor’s operational patterns.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["87.251.64.204", "193.93.194.42", "45.11.59.152"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["87.251.64.204", "193.93.194.42", "45.11.59.152"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AdaptixC2

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: AdaptixC2 IOCs detection rule:

• Scenario: Enterprise Endpoint Protection Scans

  • Context: The AdaptixC2 campaign often utilizes specific file hashes or network signatures that overlap with legitimate security software updates. For instance, CrowdStrike Falcon or Microsoft Defender for Endpoint may download a definition update package containing an IOC hash identical to one flagged by the rule during scheduled nightly scans.
  • Suggested Filter: Create an exclusion based on the process name of the security agent (e.g., C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe) or exclude traffic originating from known internal update servers (e.g., 10.20.5.15 for WSUS) when the destination port is 443 and the user context is a system account (SYSTEM).

• Scenario: Scheduled Backup Jobs

  • Context: Automated backup solutions like Veeam Backup & Replication or Rubrik frequently generate network connections to offsite repositories that match the AdaptixC2 command-and-control (C2) IP ranges. These jobs often run during business hours on specific days, triggering the rule when the backup agent initiates a heartbeat or data transfer session.
  • Suggested Filter: Implement a time-based exclusion for the specific backup service account (e.g., DOMAIN\BackupSvc) running between 02:00 and 06:00 UTC on weekdays. Additionally, exclude connections where the process path contains \Veeam\ or \RubrikAgent\.

• Scenario: Legitimate Cloud Management Tools

  • Context: IT administrators often use cloud management platforms like ServiceNow, Jira, or Microsoft Azure DevOps which host