ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt detects adversary activity involving known AdaptixC2 command-and-control infrastructure by matching network traffic against specific ThreatFox indicators of compromise. Proactively hunting for these IOCs in Azure Sentinel is critical to identify early-stage lateral movement or data exfiltration attempts before the threat escalates into a full-blown incident.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["31.77.228.179", "118.107.23.86"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["31.77.228.179", "118.107.23.86"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AdaptixC2

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Security Tool Updates

  • Context: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) frequently download definition updates or configuration scripts from the AdaptixC2 infrastructure to maintain threat intelligence feeds. These legitimate downloads often match the rule’s IOCs, triggering alerts during scheduled update windows.
  • Filter/Exclusion: Create a process exclusion for known security agents (e.g., FalconSensor.exe, MsMpEng.exe) connecting to AdaptixC2 IP ranges or domains. Additionally, filter out events occurring within the defined maintenance window (e.g., 02:00–04:00 UTC) where these updates are typically pushed.

• Scenario: Scheduled Backup and Data Synchronization Jobs

  • Context: IT operations teams often utilize AdaptixC2 as a central repository for backup metadata or configuration synchronization. Scheduled tasks (e.g., Task Scheduler jobs named “Daily_Config_Sync” or PowerShell scripts running via PowerShell.exe) connect to these IOCs nightly to archive logs or sync policy states, mimicking C2 traffic patterns.
  • Filter/Exclusion: Exclude network connections where the source process is a known backup agent (e.g., VeeamAgent.exe, AcronisCyberProtect.exe) and the destination matches AdaptixC2 IOCs. Implement a filter that ignores traffic from specific service accounts used for these jobs, such as DOMAIN\svc_backup_admin.

• Scenario: Third-Party SaaS Integration via API

  • Context: Business applications (e.g., ServiceNow, Jira, or custom ERP systems) integrate