This hunt targets known indicators of compromise associated with the AdaptixC2 framework, which adversaries use to establish persistent command-and-control channels for data exfiltration and remote execution. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised assets early, mitigating the risk of lateral movement and privilege escalation before the adversary achieves their operational objectives.
Malware Family: AdaptixC2 Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 82[.]115[.]16[.]4:4321 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 31[.]77[.]161[.]250:5667 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 193[.]233[.]49[.]79:4321 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 193[.]239[.]237[.]120:50091 | botnet_cc | 2026-09-08 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["193.239.237.120", "193.233.49.79", "82.115.16.4", "31.77.161.250"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["193.239.237.120", "193.233.49.79", "82.115.16.4", "31.77.161.250"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Legacy Web Application Maintenance: A legacy internal web application (e.g., built on PHP or Python) uses an outdated version of the adaptix library for data transformation tasks. During a scheduled nightly ETL job, the application process spawns a child process to execute a specific data parsing script, matching the binary hash or path IOC.
php-fpm.exe, python.exe, or node.exe and the command line contains specific keywords like --parse or --transform, or exclude the specific file path if the IOC is path-based (e.g., C:\Apps\LegacyETL\bin\adaptix_worker.exe).Third-Party Backup Agent: A third-party backup solution (e.g., Veeam, Commvault, or Acronis) includes a utility component named adaptix_c2_helper.dll or a similarly named executable for its agent communication module. This component is loaded by the backup service during regular incremental backups.
C:\Program Files\Commvault\... or C:\Program Files (x86)\Veeam\...) and the parent process is the known backup service executable (e.g., cvaux.exe, vbragent.exe).Developer Local Testing Environment: A developer on a workstation is running a local instance of a microservice that uses a containerized version of the Adaptix framework for API testing. The container runtime (Docker Desktop or Podman) creates a process on the host that matches the IOC hash or name, but it is isolated within a user profile directory.