Adversaries are using AdaptixC2 command and control infrastructure to exfiltrate data and maintain persistent access within the network. SOC teams should proactively hunt for these IOCs in Azure Sentinel to identify and disrupt potential long-term compromise and data theft operations.
IOC Summary
Malware Family: AdaptixC2 Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 89[.]125[.]255[.]29:4321 | botnet_cc | 2026-05-18 | 75% |
| ip:port | 138[.]124[.]90[.]26:51337 | botnet_cc | 2026-05-18 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["138.124.90.26", "89.125.255.29"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["138.124.90.26", "89.125.255.29"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: Legitimate scheduled job running hunting.exe as part of a SIEM data collection process
Filter/Exclusion: process.name != "hunting.exe" or process.parent.name != "SIEMCollector.exe"
Scenario: System administrator using Process Explorer to investigate high CPU usage
Filter/Exclusion: process.name != "ProcessExplorer.exe" or user.name != "admin"
Scenario: Security tool OSSEC performing a routine log analysis and triggering a false positive
Filter/Exclusion: process.name != "ossec.exe" or process.command_line contains "log_analysis"
Scenario: IT staff running a PowerShell script to automate system updates using PowerShell.exe
Filter/Exclusion: process.name != "PowerShell.exe" or process.command_line contains "Update-Module"
Scenario: Database administrator using sqlcmd to run maintenance jobs during off-peak hours
Filter/Exclusion: process.name != "sqlcmd.exe" or process.parent.name != "SQLAgent.exe"