ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt detects adversary activity involving known AdaptixC2 command-and-control infrastructure by monitoring network traffic against specific ThreatFox indicators of compromise. Proactively hunting for these signals in Azure Sentinel is critical to identify early-stage lateral movement or data exfiltration attempts before they escalate into full-scale incidents.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["193.32.162.108", "107.173.160.185"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["193.32.162.108", "107.173.160.185"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AdaptixC2

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: AdaptixC2 IOCs detection rule in an enterprise environment:

• Scenario: Legitimate Endpoint Management Traffic

  • Context: Enterprise management tools like Microsoft Intune, SCCM (System Center Configuration Manager), or Jamf Pro frequently push configuration profiles, inventory updates, and policy compliance checks to endpoints. These agents often communicate with cloud-based management servers using IP addresses or domains that may overlap with AdaptixC2’s known infrastructure or use similar TLS fingerprints.
  • Filter/Exclusion: Create a whitelist exclusion for the specific process names of the management agents (e.g., IntuneManagementExtension.exe, ccmsetup.exe) and exclude traffic originating from the internal IP ranges of your Configuration Management Servers. Additionally, filter out connections where the destination port is standard management ports (e.g., 443) and the User-Agent string contains “Microsoft Intune” or specific vendor identifiers.

• Scenario: Scheduled Backup and Data Replication Jobs

  • Context: Automated backup solutions such as Veeam, Rubrik, or Commvault run scheduled jobs during off-hours to replicate data to cloud storage or secondary sites. These agents often initiate outbound connections to external S3 buckets, Azure Blob Storage, or proprietary cloud gateways that may share network infrastructure or IP blocks with the AdaptixC2 IOCs.
  • Filter/Exclusion: Implement a time-based exclusion for these specific backup processes during their known maintenance windows (e.g., 01:00–05:00 local time). Furthermore, add an exclusion rule based on the destination IP ranges of your primary cloud storage providers and exclude process paths containing \Backup\ or specific service names like Veeam.Backup.Service.exe.

• **Scenario: Third-Party