ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt detects adversary activity involving known indicators of compromise from the AdaptixC2 command and control infrastructure to identify potential active infections within the environment. Proactively hunting for these specific IOCs in Azure Sentinel allows the SOC team to rapidly isolate compromised assets and mitigate lateral movement before the threat escalates, given the high severity associated with this C2 framework.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["173.199.70.174", "65.49.220.29"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["173.199.70.174", "65.49.220.29"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AdaptixC2

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Legitimate Software Updates via Managed Deployment Tools

  • Context: Enterprise endpoints running Microsoft Endpoint Configuration Manager (SCCM) or Ivanti Neurons often download and execute update packages from internal repositories. If the AdaptixC2 IOCs include specific file hashes or URLs used by a third-party vendor’s updater, these legitimate deployments will trigger alerts when the deployment agent connects to the vendor’s distribution point.
  • Suggested Filter/Exclusion: Create an exclusion rule that suppresses alerts where the parent process is ccmsetup.exe (SCCM) or ivanti-agent.exe, and the destination IP belongs to the internal corporate subnet (e.g., 10.x.x.x) rather than external public IPs.

• Scenario: Scheduled Administrative Backup Jobs

  • Context: Scheduled jobs running via Windows Task Scheduler often utilize backup agents like Veeam Agent for Windows or Acronis Cyber Protect. These tools frequently communicate with central management servers using specific ports and file signatures that may overlap with AdaptixC2 IOCs, particularly if the backup server utilizes a similar communication protocol or certificate chain.
  • Suggested Filter/Exclusion: Implement a filter to exclude events where the process name matches VeeamAgent.exe or AcronisBackupService.exe and the event timestamp falls within defined maintenance windows (e.g., 01:00–05:00 local time) on non-business days.

• Scenario: Security Tool Communication with Cloud Intelligence Feeds

  • Context: Internal security solutions, such as CrowdStrike Falcon or SentinelOne,