This hypothesis targets the presence of known AdaptixC2 indicators of compromise, which are frequently used by threat actors to establish persistent command-and-control channels for data exfiltration and lateral movement. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised assets early, potentially disrupting the adversary’s operational timeline before they achieve their full objectives.
Malware Family: AdaptixC2 Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 45[.]112[.]206[.]54:55005 | botnet_cc | 2026-09-17 | 75% |
| ip:port | 209[.]99[.]188[.]193:4322 | botnet_cc | 2026-09-17 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["45.112.206.54", "209.99.188.193"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.112.206.54", "209.99.188.193"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Legacy Application Update Mechanism: A widely deployed legacy Java-based enterprise application (e.g., an internal HR portal or legacy ERP client) uses a hardcoded IP address or specific domain for its auto-update check-in. If the ThreatFox IOC list includes a generic IP range or a domain that overlaps with the vendor’s update server, this routine background process will trigger the rule.
java.exe or the application’s specific executable name) when the destination matches the known vendor update IP/domain, or whitelist the specific hash of the update checker binary if it is signed by the vendor.Scheduled Health Check from Monitoring Agents: Enterprise monitoring agents (such as Datadog, New Relic, or custom PowerShell scripts) often perform periodic health checks by pinging specific endpoints or resolving DNS for internal service discovery. If the AdaptixC2 IOCs include a common port (e.g., 443) or a specific DNS query pattern that coincides with the monitoring agent’s heartbeat mechanism, legitimate traffic will be flagged.
datadog-agent.exe, nrtray.exe, or powershell.exe running a specific scheduled task) and the destination is an internal IP range or a known monitoring domain.Development Team’s Local Testing Environment: Developers in a software engineering team may spin up local instances of third-party libraries or test harnesses that mimic C2 behaviors for unit testing. For example, a developer might run a Python script that connects to a local mock server or a public test endpoint that happens to match one of the AdaptixC2 IOCs (e.g., a specific user-agent string or a known test IP).