This hypothesis targets the presence of known AdaptixC2 infrastructure indicators, which are frequently leveraged by threat actors to establish persistent command-and-control channels for data exfiltration and remote execution. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised assets early, preventing adversaries from leveraging this C2 framework to orchestrate further lateral movement or payload delivery within the environment.
Malware Family: AdaptixC2 Total IOCs: 3 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 46[.]225[.]119[.]0:8090 | botnet_cc | 2026-09-16 | 75% |
| ip:port | 45[.]249[.]89[.]172:4321 | botnet_cc | 2026-09-16 | 75% |
| ip:port | 206[.]206[.]103[.]203:29578 | botnet_cc | 2026-09-16 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["206.206.103.203", "45.249.89.172", "46.225.119.0"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["206.206.103.203", "45.249.89.172", "46.225.119.0"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: Developer CI/CD Pipeline Build Artifacts
/tmp/build_artifacts/) during integration testing. The file is executed briefly to verify connectivity before being deleted.C:\Users\*\AppData\Local\Temp\build_* or /tmp/build_artifacts/ where the parent process is a known CI agent (e.g., jenkins.exe, drone-runner, github-actions-runner).Scenario: Security Team Red Team/Blue Team Drills
REDTEAM-TEST-01) to validate detection coverage. The implant is intentionally left running for 4 hours to simulate persistence.red-team-drill or security-test in CMDB/Asset Inventory. Alternatively, exclude if the process parent is powershell.exe or wsl.exe and the working directory contains redteam or drill in the path name.Scenario: Legacy Application Update Service
LegacyERPClient.exe) uses a scheduled task (UpdateCheck) that downloads a small updater binary from an internal mirror. Due to a packaging error, the updater binary’s SHA256 or size matches one of the AdaptixC2 IOCs. The task runs every Monday at 02:00 AM.