ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt targets adversary command and control activities by identifying network traffic matching three specific indicators of compromise linked to the AdaptixC2 framework. Proactively searching for these signals in Azure Sentinel is critical because early detection of this C2 infrastructure allows the SOC team to isolate compromised assets before lateral movement or data exfiltration occurs.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["38.54.8.74", "107.172.90.117", "45.198.224.94"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["38.54.8.74", "107.172.90.117", "45.198.224.94"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AdaptixC2

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule in an enterprise environment, along with recommended filters and exclusions:

• Endpoint Management Software Updates

  • Scenario: The organization utilizes Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ivanti Neurons to push security updates. During a scheduled maintenance window, the update agent downloads and executes installation packages that contain legitimate binaries matching AdaptixC2 IOCs (specifically known benign hash collisions in shared libraries like mscoree.dll or specific C2 communication patterns used by the vendor’s updater).
  • Filter/Exclusion: Create an exclusion rule for processes originating from the specific software update service accounts (e.g., NT SERVICE\ccmexec or IvantiAgentService) and restrict the detection to only flag events where the parent process is not a known enterprise management executable.

• Third-Party SaaS Integration Scans

  • Scenario: A scheduled job runs via Tenable Nessus or Qualys Cloud Agent performing an internal vulnerability assessment. The scanner initiates outbound connections to its cloud management portal and downloads plugin updates that trigger the AdaptixC2 IOCs, particularly those related to beaconing behavior on standard ports (443/80) which mimic C2 traffic.
  • Filter/Exclusion: Exclude network flows where the source IP belongs to the internal vulnerability scanning subnet and the destination domain matches the known SaaS provider’s CDN domains (e.g., *.tenable.com or *.qualys.com). Additionally, whitelist the specific process names of the scanner agents (nsagent.exe, qagent.exe).

• Automated Backup and Archiving Tasks

  • Scenario: The enterprise runs a nightly backup job using **Veeam Backup & Rep