ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt detects adversary command and control activities linked to the AdaptixC2 framework by identifying network traffic matching its specific indicators of compromise. Proactively hunting for these behaviors in Azure Sentinel is critical to rapidly identify early-stage intrusions and mitigate potential lateral movement before the threat escalates within the cloud environment.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["138.124.90.26", "217.217.97.111"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["138.124.90.26", "217.217.97.111"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AdaptixC2

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Security Agent Updates and Telemetry Uploads

  • Scenario: Enterprise Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint, frequently download definition updates and upload telemetry data to their respective cloud command centers. If the AdaptixC2 IOCs include specific IP ranges or domains used by these vendors’ update servers, legitimate background traffic from thousands of workstations will trigger alerts during peak update windows (e.g., early morning).
  • Suggested Filter/Exclusion: Create a rule exclusion for process paths associated with known EDR agents (e.g., C:\Program Files\CrowdStrike\csagent.exe or C:\Windows\System32\MsMpEng.exe) communicating with the specific AdaptixC2 IP ranges. Alternatively, exclude traffic originating from the “Endpoint Management” organizational unit in Active Directory during scheduled maintenance windows.

• Third-Party Patch Management and Software Distribution

  • Scenario: Automated patch management tools like Ivanti, ManageEngine Endpoint Central, or Microsoft SCCM (Configuration Manager) often utilize external repositories to fetch software updates, drivers, or application installers. If the AdaptixC2 IOCs correspond to a content delivery network (CDN) or a specific software vendor’s repository used by these tools, scheduled deployment jobs running on domain controllers or patch servers will generate high-volume legitimate connections.
  • Suggested Filter/Exclusion: Exclude network traffic initiated by service accounts dedicated to patch management (e.g., svc-patch-mgmt or Administrator) and specific process names like ccmexec.exe (SCCM) or `