ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hypothesis targets the presence of known AdaptixC2 indicators of compromise, which are frequently used by adversaries to establish persistent command-and-control channels for data exfiltration and remote execution. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised endpoints or network flows before the adversary can fully leverage the C2 infrastructure to escalate privileges or move laterally within the environment.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["203.88.118.26", "155.138.215.87", "137.175.107.110"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["203.88.118.26", "155.138.215.87", "137.175.107.110"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AdaptixC2

False Positive Guidance

• Scenario: A security operations team or threat intelligence platform (e.g., MISP, Cortex XSOAR) automatically ingests and validates new IOCs from the ThreatFox feed, creating temporary files or database entries containing the AdaptixC2 hashes/URLs for correlation analysis.
  • Filter/Exclusion: Exclude events where the source process is a known threat intelligence tool (e.g., cortex.exe, misp-client.exe) or where the file path resides in a dedicated threat intelligence staging directory (e.g., C:\ProgramData\ThreatIntel\staging\).
• Scenario: An enterprise endpoint protection platform (EPP) like CrowdStrike Falcon or SentinelOne performs a “hunt” or retrospective scan, reading historical memory dumps or disk images that contain the AdaptixC2 IOCs as part of a scheduled integrity check or post-incident forensics.
  • Filter/Exclusion: Exclude detections where the parent process is the EPP agent (e.g., FalconSensor.exe, SentinelOneAgent.exe) and the action is a read/scan operation rather than an execution or write, or exclude paths under the EPP’s local data directory (e.g., C:\ProgramData\CrowdStrike\).
• Scenario: A DevOps or Site Reliability Engineering (SRE) team uses a custom PowerShell or Python script to automate the deployment of updated blocklists or allowlists, which temporarily writes the AdaptixC2 IOCs to a configuration file (e.g., c2_blocklist.json) in a shared network drive or local build folder.
  • Filter/Exclusion: Exclude events where the writing process is a scripting host (e.g., powershell.exe, python.exe) and the destination path matches known build or configuration directories (e.g., C:\Builds\, `D:\Configs