ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt detects adversary activity involving known indicators of compromise from the AdaptixC2 command and control infrastructure to identify potential lateral movement or data exfiltration attempts. Proactively hunting for these IOCs within Azure Sentinel is critical because early detection of this specific C2 channel allows the SOC team to isolate affected assets before adversaries can establish persistent access or escalate privileges.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["103.146.231.107", "103.140.154.7"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["103.146.231.107", "103.140.154.7"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AdaptixC2

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Endpoint Protection Engine Updates

  • Scenario: The organization’s primary endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) initiates a scheduled daily update cycle. During this process, the engine downloads signature definitions and configuration blobs from the vendor’s cloud repository, which may contain hash values matching known AdaptixC2 IOCs hosted on public CDN infrastructure.
  • Suggested Filter/Exclusion: Create an exclusion rule that filters out network traffic or file hashes originating from specific trusted update servers (e.g., *.crowdstrike.com, *.microsoftonline.net) during the defined maintenance window (e.g., 02:00 – 04:00 UTC). Additionally, exclude processes running under the service account SYSTEM or specific vendor service names like FalconService.

• Automated Patch Management Deployment

  • Scenario: The IT Operations team utilizes a centralized patch management tool (e.g., Microsoft SCCM/MECM or Ivanti Neurons) to deploy critical security patches. The deployment agent communicates with the central distribution point, and the installation logs or temporary cache files generated during the rollout may match AdaptixC2 IOCs associated with legitimate software supply chain repositories.
  • Suggested Filter/Exclusion: Implement a process-based exclusion for the patch management agents (e.g., ccmsetup.exe, IvantiAgentService). Configure the detection logic to ignore alerts where the parent process is the patch orchestrator and the destination IP belongs to the internal DMZ range or known vendor distribution points.

• Third-Party Cloud Backup Synchronization

  • Scenario: Enterprise