ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt targets adversary command and control activities by identifying network traffic matching the specific Indicators of Compromise (IOCs) linked to the AdaptixC2 infrastructure. Proactively hunting for these signatures in Azure Sentinel is critical because early detection of AdaptixC2 communications can reveal persistent threats before they escalate into full-scale data exfiltration or lateral movement incidents.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["144.31.62.81", "31.220.93.222"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["144.31.62.81", "31.220.93.222"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AdaptixC2

False Positive Guidance

Here are four specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Security Management Console Updates

  • Scenario: The centralized management server (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) initiates a scheduled policy update or sensor upgrade. This process often establishes outbound connections to the vendor’s cloud infrastructure, which may share IP ranges or domain names with known AdaptixC2 Command & Control (C2) infrastructure due to shared hosting providers or CDN usage.
  • Filter/Exclusion: Create an exclusion for traffic originating from specific Endpoint Management Server IPs connecting to the vendor’s update endpoints. Additionally, exclude processes running under the SYSTEM account with a known digital signature hash matching the EDR management agent (e.g., falcon.sys or SentinelOne.exe).

• Automated Software Distribution via SCCM/Intune

  • Scenario: A scheduled deployment job using Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune pushes a critical patch to the fleet. The distribution point servers communicate with external content repositories that may resolve to IP addresses flagged as AdaptixC2 IOCs, particularly if the repository utilizes a shared content delivery network (CDN) like Akamai or Cloudflare which hosts multiple tenants.
  • Filter/Exclusion: Filter out traffic generated by the ccmexec.exe process (SCCM) or Microsoft.Store.Apps.UI (Intune) during standard maintenance windows (e.g., 02:00–04:00 UTC). Implement a whitelist for specific destination ports (80/443) when the source is identified as an internal Distribution Point Server.

• **Third-Party Backup and