ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This detection identifies adversary activity involving command and control communications from the AdaptixC2 infrastructure by monitoring three specific indicators of compromise. A proactive hunt is essential in Azure Sentinel to rapidly detect early-stage lateral movement or data exfiltration attempts before they escalate into broader incidents within the cloud environment.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["138.124.62.3", "89.36.231.206", "45.139.226.224"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["138.124.62.3", "89.36.231.206", "45.139.226.224"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AdaptixC2

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule, including suggested filters and exclusions tailored for a legitimate enterprise environment:

• Scenario: Endpoint Protection Agent Communication

  • Context: Enterprise EDR agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently communicate with their management consoles or threat intelligence feeds. If the AdaptixC2 IOCs include specific IP ranges or domain suffixes that overlap with the vendor’s cloud infrastructure, legitimate heartbeat checks or policy updates may trigger alerts.
  • Suggested Filter/Exclusion: Create a rule exclusion for traffic originating from the CrowdStrike Falcon Sensor service (PID 1052) or MsMpEng.exe communicating with known vendor IP ranges. Alternatively, exclude any network connection where the destination port is 443 and the source process hash matches the signed EDR agent binary.

• Scenario: Scheduled Backup and Data Archiving Jobs

  • Context: Automated backup solutions like Veeam or Commvault often utilize external cloud storage buckets (e.g., AWS S3, Azure Blob) that may share DNS patterns or IP addresses with AdaptixC2 infrastructure. A nightly scheduled job running via Windows Task Scheduler might initiate a large data transfer to these endpoints, matching the detection logic for C2 traffic.
  • Suggested Filter/Exclusion: Exclude alerts where the source process is VeeamTransport.exe or CommServe.exe and the execution time aligns with defined maintenance windows (e.g., 01:00–05:00 UTC). Add a filter to ignore connections initiated by these specific processes when the destination domain contains keywords like .backup.cloud or matches the backup vendor’s known ASN.

• Scenario: Third-Party Software Update Mechanisms

  ---