This hunt identifies potential compromise by matching network traffic or host artifacts against known Indicators of Compromise (IOCs) associated with the AdaptixC2 command-and-control framework. Proactively hunting for these specific IOCs allows the SOC to detect active adversary infrastructure and establish a foothold before the threat actor can fully leverage the C2 channel for lateral movement or data exfiltration.
Malware Family: AdaptixC2 Total IOCs: 9 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 80[.]96[.]108[.]225:65432 | botnet_cc | 2026-09-10 | 75% |
| ip:port | 69[.]48[.]229[.]91:65500 | botnet_cc | 2026-09-10 | 75% |
| ip:port | 38[.]54[.]97[.]169:4321 | botnet_cc | 2026-09-10 | 75% |
| ip:port | 154[.]13[.]7[.]196:4321 | botnet_cc | 2026-09-10 | 75% |
| ip:port | 144[.]172[.]65[.]54:4321 | botnet_cc | 2026-09-10 | 75% |
| ip:port | 143[.]246[.]217[.]103:25729 | botnet_cc | 2026-09-10 | 75% |
| ip:port | 185[.]193[.]127[.]10:8080 | botnet_cc | 2026-09-10 | 100% |
| ip:port | 185[.]193[.]127[.]10:80 | botnet_cc | 2026-09-10 | 100% |
| ip:port | 185[.]193[.]127[.]10:443 | botnet_cc | 2026-09-10 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["143.246.217.103", "38.54.97.169", "154.13.7.196", "80.96.108.225", "69.48.229.91", "144.172.65.54", "185.193.127.10"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["143.246.217.103", "38.54.97.169", "154.13.7.196", "80.96.108.225", "69.48.229.91", "144.172.65.54", "185.193.127.10"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses a standard CI/CD pipeline (e.g., Jenkins or GitHub Actions) to deploy a new microservice that includes a dependency on the adaptix library or a similar C2 framework for internal testing purposes. The IOC match occurs because the binary or script contains the specific string hash or network beacon pattern associated with the threat, but it is part of a scheduled build job running on a known build agent.
jenkins-agent.exe, github-runner.exe) and the destination IP is within the internal CI/CD subnet range.Scenario: An IT administrator performs a manual patch deployment using a custom PowerShell script that downloads a utility from a trusted internal repository. The script uses a hardcoded URL or hash that coincidentally matches one of the 9 IOCs due to a shared component or similar code structure, triggering the rule during a routine maintenance window.
powershell.exe or pwsh.exe and the parent process is a known administrative tool (e.g., wsadmin.exe, sc.exe) or if the execution time falls within a pre-defined maintenance window (e.g., 02:00–04:00 UTC).Scenario: A security team conducts a periodic vulnerability scan using a tool like Nessus or Qualys, which spins up temporary agents or probes on endpoints. These probes may execute small, short-lived scripts or binaries that match the IOCs because they are designed to mimic common attack patterns for testing, or they use a shared library that contains the specific IOC string.
nessus-server,