This hypothesis targets the presence of known AdaptixC2 command-and-control infrastructure, indicating that an adversary is likely establishing or maintaining a persistent communication channel to exfiltrate data or receive instructions. Proactively hunting for these IOCs in Azure Sentinel is critical because AdaptixC2 is a high-severity threat actor often associated with targeted intrusions, allowing the SOC to identify compromised assets before the adversary can execute further lateral movement or privilege escalation.
Malware Family: AdaptixC2 Total IOCs: 8 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 91[.]92[.]241[.]187:4321 | botnet_cc | 2026-09-06 | 75% |
| ip:port | 91[.]92[.]241[.]184:4321 | botnet_cc | 2026-09-06 | 75% |
| ip:port | 45[.]77[.]203[.]212:50442 | botnet_cc | 2026-09-06 | 75% |
| ip:port | 185[.]227[.]152[.]231:4321 | botnet_cc | 2026-09-06 | 75% |
| ip:port | 109[.]123[.]245[.]205:4321 | botnet_cc | 2026-09-06 | 75% |
| ip:port | 103[.]79[.]76[.]207:4321 | botnet_cc | 2026-09-06 | 75% |
| ip:port | 31[.]77[.]161[.]250:80 | botnet_cc | 2026-09-06 | 100% |
| ip:port | 31[.]77[.]161[.]250:8080 | botnet_cc | 2026-09-06 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["109.123.245.205", "91.92.241.187", "103.79.76.207", "91.92.241.184", "185.227.152.231", "31.77.161.250", "45.77.203.212"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["109.123.245.205", "91.92.241.187", "103.79.76.207", "91.92.241.184", "185.227.152.231", "31.77.161.250", "45.77.203.212"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps team deploys a new microservice using a container image that includes a lightweight HTTP client library (e.g., curl or wget) configured to poll a staging API endpoint for health checks. If the staging IP address or domain matches one of the 8 IOCs (e.g., a shared CDN IP or a generic test domain), the rule triggers.
dockerd, containerd-shim) or where the destination port is 80/443 and the user agent string contains “health-check” or “k8s-probe”.Scenario: An IT administrator runs a manual network connectivity test using ping or Test-NetConnection against a known AdaptixC2 IP to verify firewall rules or routing paths before a maintenance window. This legitimate diagnostic activity generates the same network beaconing pattern as the malware.
ping.exe, Test-NetConnection (PowerShell), or nmap, and the user account belongs to the IT-Admins or Network-Engineers security group.Scenario: A legacy application or backup agent (e.g., Veeam, Commvault) uses a hardcoded IP address for its license server or update repository that coincidentally matches one of the AdaptixC2 IOCs. This is common in older enterprise software that hasn’t been updated to use DNS names.
veeam.exe, commvault.exe, licensing-service.exe) and the destination port is 443 or 8080.Scenario: A security