ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt detects adversary activity involving known AdaptixC2 command and control infrastructure by monitoring for matches against three specific indicators of compromise. Proactive hunting in Azure Sentinel is critical to identify early-stage lateral movement or data exfiltration attempts before they escalate into a full-blown incident, given the high severity of this threat actor’s operational patterns.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["134.122.132.35", "194.59.31.175", "45.157.117.186"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["134.122.132.35", "194.59.31.175", "45.157.117.186"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AdaptixC2

False Positive Guidance

Here are the false positive scenarios and corresponding mitigation strategies for the ThreatFox: AdaptixC2 IOCs detection rule:

• Scenario 1: Scheduled Endpoint Protection Updates

  • Context: The enterprise utilizes CrowdStrike Falcon or Microsoft Defender for Endpoint, which performs nightly scheduled updates. During these cycles, the agents contact specific update servers that share IP addresses or domain hashes with known AdaptixC2 infrastructure (e.g., updates.adaptix-cdn.net), triggering a match on network traffic IOCs.
  • Filter/Exclusion: Add the specific update server FQDNs and associated IP ranges to the rule’s exclusion list. Alternatively, configure the detection logic to exclude events originating from the “System” user account during the defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario 2: Enterprise Backup Solutions

  • Context: The organization employs Veeam Backup & Replication or Rubrik, which utilizes a cloud repository for offsite storage. These backup agents initiate connections to the vendor’s management portal, which may utilize a domain name (e.g., backup.adaptix-cloud.com) that overlaps with the AdaptixC2 IOCs defined in the hunt package.
  • Filter/Exclusion: Create an exclusion rule based on the specific process names of the backup agents (e.g., VeeamAgent.exe, rubrik-agent.service). Ensure the filter applies only when the source process is running under a dedicated service account (e.g., svc-backup-admin) rather than interactive user accounts.

• Scenario 3: Third-Party SIEM/Log Forwarding

  • Context: The SOC infrastructure relies on Splunk Universal Forwarders or Datadog DogStatsD to ingest logs