ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific indicators of compromise (IOCs) linked to the AdaptixC2 command and control infrastructure, which adversaries leverage to maintain persistent access and exfiltrate data from compromised endpoints. The SOC team should proactively hunt for these IOCs within Azure Sentinel to identify early-stage infections or lateral movement that may evade standard signature-based detection, thereby reducing dwell time before full compromise occurs.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["194.76.226.90", "203.161.55.41", "202.73.4.82"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["194.76.226.90", "203.161.55.41", "202.73.4.82"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AdaptixC2

False Positive Guidance

False Positive Scenarios for “ThreatFox: AdaptixC2 IOCs”

• Legitimate Endpoint Protection Updates

  • Scenario: The organization’s primary endpoint security suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) initiates a scheduled definition update. This process connects to the vendor’s cloud infrastructure, which shares IP ranges or domain names with the AdaptixC2 IOCs, triggering the rule when the agent polls for new signatures during peak business hours.
  • Filter/Exclusion: Exclude traffic originating from known Endpoint Protection management servers (e.g., falcon.crowdstrike.com or go.microsoft.com) and restrict detection to non-standard ports if the update service uses a dedicated port range distinct from standard web browsing.

• Third-Party Cloud Backup Jobs

  • Scenario: A scheduled nightly backup job using Veeam Backup & Replication or Rubrik connects to an external cloud storage repository (e.g., AWS S3 or Azure Blob) that utilizes infrastructure overlapping with the AdaptixC2 IOCs. The rule triggers when the backup agent establishes a persistent connection to upload incremental data blocks, mimicking command-and-control traffic patterns.
  • Filter/Exclusion: Create an exclusion list for specific Service Accounts (e.g., svc-backup-agent) and whitelist the destination IP ranges of known cloud storage providers used by the enterprise’s backup solution.

• Software Deployment via Configuration Management

  • Scenario: An automated deployment cycle runs using Ansible Tower or Microsoft SCCM to push patches to a fleet of workstations. The configuration management server communicates with external repositories (such as GitHub Actions runners or Docker Hub) that share network signatures with the AdaptixC2 indicators, causing false alerts during the “push” phase of the deployment window.
  • Filter/Exclusion: Filter out traffic generated by specific