ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt detects adversary activity by identifying network traffic and endpoint events matching six specific Indicators of Compromise (IOCs) linked to the AdaptixC2 command-and-control infrastructure. Proactively hunting for these IOCs in Azure Sentinel is critical because AdaptixC2 represents a sophisticated threat actor capable of establishing persistent access, requiring early detection to mitigate potential data exfiltration or lateral movement before full compromise occurs.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 6 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`8ef70ff2c501ca4e271dd549e29d1ad1`	payload	2026-08-07	95%
sha256_hash	`93fedc7b3f885aa9741fe7bbe171baded81188a5aeee3fecc636f3721587b702`	payload	2026-08-07	95%
sha1_hash	`bf8d02a3f3c536fcf917fb4327060979d1f75509`	payload	2026-08-07	95%
sha1_hash	`68a6877be539bdc70f6956c2b3f2aabe095b9d3a`	payload	2026-08-07	95%
md5_hash	`fe720b7550466baa14994a090eed156d`	payload	2026-08-07	95%
sha256_hash	`664c8ea6640f0e3f8bd5ba3429656635d59f8272e37e0cdf646a1613efda9d8f`	payload	2026-08-07	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - AdaptixC2
let malicious_hashes = dynamic(["8ef70ff2c501ca4e271dd549e29d1ad1", "93fedc7b3f885aa9741fe7bbe171baded81188a5aeee3fecc636f3721587b702", "bf8d02a3f3c536fcf917fb4327060979d1f75509", "68a6877be539bdc70f6956c2b3f2aabe095b9d3a", "fe720b7550466baa14994a090eed156d", "664c8ea6640f0e3f8bd5ba3429656635d59f8272e37e0cdf646a1613efda9d8f"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — AdaptixC2

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Legitimate Endpoint Security Agent Communication
- Context: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) often communicate with their respective cloud management consoles. If the AdaptixC2 IOCs include specific IP addresses or domain hashes that overlap with these vendor infrastructure, the security agents’ heartbeat and telemetry uploads may trigger alerts.
- Filter/Exclusion: Create a rule exclusion based on the Process Name (e.g., falcon.sys, s1agent.exe, MsMpEng.exe) and restrict the alert to only fire if the destination IP is not within the known vendor CIDR ranges. Alternatively, whitelist the specific SHA-256 hashes of these security agent binaries in the detection logic.
Scenario: Scheduled Backup Jobs via Cloud Storage
- Context: Automated backup solutions (such as Veeam, Rubrik, or Azure Backup) frequently initiate network connections to cloud storage endpoints during off-hours. If AdaptixC2 IOCs match the DNS names or IP ranges of these cloud storage gateways, scheduled backup tasks will generate false positives.
- Filter/Exclusion: Implement a time-based filter to suppress alerts for this rule between 01:00 and 05:00 (local time) when major backups run. Additionally, exclude traffic originating from specific Service Accounts (e.g., DOMAIN\BackupSvc) or processes like vrb.exe (Veeam) and AzureBackupAgent.exe.
Scenario: Third-Party SaaS Integration via API Gateway