ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt targets adversary command and control activity by identifying network traffic matching three specific ThreatFox IOCs linked to the AdaptixC2 infrastructure. Proactive detection in Azure Sentinel is critical because early identification of these indicators can reveal persistent lateral movement or data exfiltration attempts before they escalate into a full-scale incident.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["209.99.188.193", "202.1.31.83"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["209.99.188.193", "202.1.31.83"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AdaptixC2

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Security Management Console Updates

  • Scenario: The central management server (e.g., CrowdStrike Falcon, SentinelOne, or Carbon Black) initiates a scheduled policy update or definition refresh. These updates often pull threat intelligence feeds that include the specific AdaptixC2 IOCs as part of their baseline signature library, causing legitimate traffic to match the rule even when no active compromise exists on the endpoint.
  • Filter/Exclusion: Exclude network connections and process executions originating from the known management server IP ranges (e.g., 10.50.10.x for CrowdStrike) or filter by the specific service account used for updates (e.g., svc_crowdstrike_update).

• Automated Vulnerability Scanning Jobs

  • Scenario: Scheduled vulnerability scanners like Tenable Nessus, Qualys, or Rapid7 InsightVM run against internal assets. During the scan, these tools probe specific ports and inject test payloads that mimic known C2 beacon patterns to verify firewall rules and host responsiveness, inadvertently triggering the AdaptixC2 IOCs logic.
  • Filter/Exclusion: Create an exclusion for traffic generated by the scanner’s service accounts (e.g., svc_nessus_agent) or exclude connections where the destination port matches standard scanning ports (e.g., TCP 80, 443, 161) during defined maintenance windows (e.g., Sunday 02:00–06:00 UTC).

• Third-Party Cloud SaaS Integration Probes

  • Scenario: Enterprise applications utilizing cloud-based identity or security orchestration platforms (such as **