ThreatFox: AdaptixC2 IOCs

Hunt Hypothesis

This hunt targets adversary command and control activities by identifying network connections to known AdaptixC2 infrastructure indicators of compromise within the Azure Sentinel environment. Proactively hunting for these specific IOCs is critical because early detection of this established botnet’s communication patterns allows the SOC team to isolate affected assets before lateral movement or data exfiltration occurs.

IOC Summary

Malware Family: AdaptixC2 Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["193.35.17.42", "104.168.38.165"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["193.35.17.42", "104.168.38.165"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AdaptixC2

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: AdaptixC2 IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Policy Updates via Microsoft Defender for Endpoint (MDE)

  • Scenario: The MDE management console pushes a new security policy update containing a specific hash or URL associated with the AdaptixC2 campaign to all managed endpoints. This triggers network traffic from the endpoint agent (MsMpEng.exe or SenseAgent) connecting to Microsoft’s cloud infrastructure, which may be flagged if the IOCs overlap with known Microsoft update servers or if the AdaptixC2 IOC is a shared library component used by MDE.
  • Filter/Exclusion: Exclude traffic originating from the specific process names MsMpEng.exe, SenseAgent.exe, and AntimalwareService.exe when connecting to IP ranges belonging to Microsoft Azure CDN or known update endpoints (e.g., *.update.microsoft.com).

• Scheduled Third-Party Patch Management Jobs (Ivanti or SCCM)

  • Scenario: A nightly scheduled job runs the Ivanti Endpoint Manager or System Center Configuration Manager (SCCM) client agent to distribute a software patch. The patch installer (Setup.exe or PatchAgent) downloads a dependency package from a vendor repository that hosts an AdaptixC2-associated URL or file hash, generating legitimate HTTP/HTTPS traffic during the maintenance window (e.g., 02:00–04:00 UTC).
  • Filter/Exclusion: Create a time-based exclusion for the specific user accounts running these service jobs (e.g., svc-patchmgr) and exclude traffic from the SCCM/Ivanti client process IDs during defined maintenance windows.

• Cloud Backup Agent Communication (Veeam or Commvault)

  • Scenario: The