ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt detects adversary activity involving known AdaptixC2 command and control indicators to identify potential post-compromise communication or lateral movement within the network. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early detection of this C2 infrastructure allows the SOC team to isolate affected assets before adversaries can establish persistent access or exfiltrate sensitive data.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["201.51.2.186", "188.190.23.7"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["201.51.2.186", "188.190.23.7"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AdaptixC2

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule, including tailored filters and exclusions suitable for an enterprise environment:

• Scenario: Legitimate Endpoint Detection & Response (EDR) Telemetry Traffic

  • Context: The EDR agent (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) on the SVC-DEPLOYMENT server initiates outbound HTTPS connections to a known AdaptixC2 update server to fetch policy definitions and threat intelligence feeds. This traffic matches the rule’s IOCs but is part of standard maintenance.
  • Filter/Exclusion: Create an exclusion based on the source process name FalconSensor.exe (or MsMpEng.exe) where the destination IP belongs to the corporate “Trusted Update Range” subnet, and the connection type is strictly HTTPS with a valid SSL certificate chain.

• Scenario: Scheduled Backup Job Communication

  • Context: A nightly scheduled task running on the DB-PROD-01 SQL Server executes a backup routine using Veeam Backup & Replication. The job communicates with an external AdaptixC2-managed storage gateway to verify integrity, triggering the rule due to matching domain names in the DNS query logs.
  • Filter/Exclusion: Exclude alerts where the source process is Veeam.Backup.Service.exe and the execution time falls within the defined maintenance window (e.g., 02:00 – 04:30 UTC), provided the destination port is 8443.

• Scenario: Admin-Initiated Security Policy Deployment

  • Context: A System Administrator manually triggers a policy update via the AdaptixC2 console from their workstation (ADM-WIN-10). The admin’s browser (Chrome) or PowerShell script connects to