ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt detects adversary activity involving AdaptixC2 command and control infrastructure by identifying traffic or logs matching its specific indicators of compromise. Proactively hunting for these signals in Azure Sentinel is critical to rapidly identify early-stage intrusions leveraging this C2 framework before they escalate into broader network compromises.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["45.195.8.67", "57.129.92.151"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.195.8.67", "57.129.92.151"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AdaptixC2

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: AdaptixC2 IOCs detection rule in an enterprise environment:

• Scenario: Legitimate Software Deployment via Configuration Management Tools

  • Context: Enterprise IT teams often use tools like Ansible, Puppet, or Microsoft SCCM (Endpoint Manager) to push security updates or agent configurations. These tools may initiate network connections to AdaptixC2 cloud endpoints for license validation, policy synchronization, or telemetry reporting that match the rule’s IOCs.
  • Suggested Filter/Exclusion: Create an exclusion based on the Source Host (e.g., exclude specific SCCM Management Points or Ansible Controller IPs) and the Process Name. For example: Exclude if ProcessName contains "ccmexec.exe" OR "ansible-playbook" AND Source IP is in the range of internal management subnets.

• Scenario: Scheduled Backup Jobs Connecting to Cloud Repositories

  • Context: Automated backup solutions such as Veeam, Rubrik, or Commvault often run scheduled nightly jobs that communicate with external cloud storage providers. If AdaptixC2 is integrated into the organization’s data protection stack, these scheduled jobs will trigger network sessions matching the detection logic during their execution windows (e.g., 01:00–04:00 UTC).
  • Suggested Filter/Exclusion: Implement a time-based exclusion combined with process filtering. Exclude if ProcessName is "vrb_service.exe" OR "commvault_agent" AND the event occurs between 01:00 and 05:00 local time on weekdays.

• Scenario: Third-Party SaaS Integration for Identity or Ticketing

  • Context: The organization may utilize a third-party identity provider (e.g., Okta,