ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

Adversaries using AdaptixC2 are likely establishing command and control communication through specific IOCs observed in network traffic. SOC teams should proactively hunt for these IOCs in Azure Sentinel to detect and mitigate potential compromise of Azure environments.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["209.99.187.22", "193.24.123.160"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["209.99.187.22", "193.24.123.160"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AdaptixC2

False Positive Guidance

• Scenario: Legitimate scheduled job running hunting.exe as part of a security tool’s IOC analysis
  Filter/Exclusion: process.name != "hunting.exe" or process.parent.name == "security_tool.exe"

• Scenario: System administrator using adaptix.exe as a custom script for log parsing
  Filter/Exclusion: process.name != "adaptix.exe" or user.name == "admin"

• Scenario: Regular execution of a backup tool that uses adaptix_c2.exe for network monitoring
  Filter/Exclusion: process.name != "adaptix_c2.exe" or process.parent.name == "backup_tool.exe"

• Scenario: Use of adaptix_c2.exe by a third-party security tool for threat intelligence lookup
  Filter/Exclusion: process.name != "adaptix_c2.exe" or process.parent.name == "third_party_tool.exe"

• Scenario: Scheduled execution of a PowerShell script that uses adaptix_c2.ps1 for IOC validation
  Filter/Exclusion: process.name != "powershell.exe" or script.name != "adaptix_c2.ps1"