This hunt targets the presence of five specific IOCs linked to the AdaptixC2 framework, which adversaries use to establish command-and-control channels for data exfiltration and remote execution. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised assets early, potentially disrupting the attacker’s ability to maintain persistent access and escalate privileges within the environment.
Malware Family: AdaptixC2 Total IOCs: 5 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 66[.]179[.]30[.]218:65432 | botnet_cc | 2026-09-07 | 75% |
| ip:port | 23[.]148[.]212[.]254:4321 | botnet_cc | 2026-09-07 | 75% |
| ip:port | 213[.]209[.]159[.]36:1879 | botnet_cc | 2026-09-07 | 75% |
| ip:port | 192[.]253[.]226[.]10:4321 | botnet_cc | 2026-09-07 | 75% |
| ip:port | 171[.]113[.]113[.]19:8001 | botnet_cc | 2026-09-07 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["23.148.212.254", "66.179.30.218", "213.209.159.36", "192.253.226.10", "171.113.113.19"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["23.148.212.254", "66.179.30.218", "213.209.159.36", "192.253.226.10", "171.113.113.19"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
msiexec.exe, setup.exe, or a specific vendor-named binary like app_updater.exe) and the destination path is within the application’s local install directory (e.g., C:\Program Files\VendorApp\).datadog-agent.exe, nrsysmond.exe) and the network connection is established over a standard telemetry port (e.g., 443, 8125) from a server role designated as “Monitoring” or “Telemetry Collector.”