ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt detects adversary command and control activity by identifying network communications matching known AdaptixC2 indicators of compromise within Azure Sentinel. Proactive hunting is essential to rapidly identify early-stage infections and prevent lateral movement before the threat actor establishes a persistent foothold in the environment.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["104.253.79.117", "192.162.199.180"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["104.253.79.117", "192.162.199.180"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AdaptixC2

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Enterprise Endpoint Protection Updates

  • Context: The organization uses a commercial EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) that periodically downloads definition updates from the AdaptixC2 vendor’s cloud repository. These updates often contain hash signatures matching the rule’s IOCs, triggering alerts on every workstation during the update window.
  • Filter/Exclusion: Create a time-based exclusion allowing the detection to run only outside of standard maintenance windows (e.g., 09:00–17:00 local time). Alternatively, exclude process names associated with the EDR updater service (e.g., C:\Program Files\CrowdStrike\csfalcon.exe) from triggering this specific rule.

• Scenario: Scheduled Backup and Archive Jobs

  • Context: A nightly scheduled job using Veeam Backup & Replication or Commvault runs to archive logs to an external storage system. The backup agent communicates with the AdaptixC2 cloud for metadata synchronization, generating network traffic that matches the rule’s IOCs on the file server hosting the backup repository.
  • Filter/Exclusion: Exclude specific scheduled tasks by name (e.g., VeeamBackupService or CommServeAgent) and restrict the detection to exclude traffic originating from known internal IP ranges dedicated to backup infrastructure (e.g., 10.20.30.0/24).

• Scenario: Third-Party SIEM Log Ingestion

  • Context: The enterprise Security Information and Event Management (SIEM) platform, such as Splunk or IBM QRadar, utilizes an internal connector to ingest threat intelligence feeds from Adapt