This hunt targets known indicators of compromise for the AdaptixC2 command-and-control framework, which adversaries use to establish persistent remote access and execute malicious payloads. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised assets early, preventing the progression from initial foothold to lateral movement or data exfiltration.
Malware Family: AdaptixC2 Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 31[.]77[.]161[.]250:2911 | botnet_cc | 2026-09-04 | 75% |
| ip:port | 154[.]211[.]89[.]86:8443 | botnet_cc | 2026-09-04 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["154.211.89.86", "31.77.161.250"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["154.211.89.86", "31.77.161.250"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Legacy Application Updates via Third-Party Patches: Enterprise environments often use third-party patch management tools (e.g., Ivanti, ManageEngine, or NinjaOne) to push updates to legacy Java or .NET applications that may inadvertently bundle or reference known AdaptixC2 hash values during the update process.
IvantiAgent.exe, ManageEngineAgent.exe) and the file location resides within standard application directories (e.g., C:\Program Files\LegacyApp\ or C:\ProgramData\ManageEngine\).Scheduled Cleanup Jobs for Temporary Files: Administrative scheduled tasks (e.g., Task Scheduler jobs named Cleanup_TempFiles or Daily_Maintenance) often execute PowerShell or batch scripts that delete or move temporary files, which may include residual artifacts from previous AdaptixC2 infections or test environments that match the IOC hashes.
del, move, Remove-Item) and the parent process is svchost.exe (specifically the Task Scheduler service, SchedSvc) or powershell.exe launched by a known admin account with a service SID.DevOps CI/CD Pipeline Artifacts: In development or staging environments, CI/CD pipelines (e.g., Jenkins, Azure DevOps, or GitLab CI) may download or build containers/images that include test binaries or sample payloads matching AdaptixC2 IOCs for integration testing or security scanning purposes.
jenkins, ci-runner, or azure-pipelines, and where the file path contains keywords such as workspace, `