This hypothesis targets the presence of known AdaptixC2 command-and-control infrastructure, indicating that an adversary may be using this tool to establish persistent remote access or exfiltrate data. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised assets early, potentially disrupting the attacker’s operational chain before it escalates to lateral movement or data exfiltration.
Malware Family: AdaptixC2 Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 94[.]26[.]248[.]76:50050 | botnet_cc | 2026-09-12 | 75% |
| ip:port | 166[.]1[.]249[.]50:4321 | botnet_cc | 2026-09-12 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["94.26.248.76", "166.1.249.50"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["94.26.248.76", "166.1.249.50"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Legacy Support Tooling Deployment: An IT operations team deploys a legacy Java-based support agent (e.g., AdaptixAgent.jar or similar) to a subset of Windows servers for remote troubleshooting. The binary’s hash or file path matches the ThreatFox IOC because the vendor reused a common build artifact or naming convention.
C:\Program Files\Adaptix\Support\) or exclude processes where the parent is a known deployment tool (e.g., ps.exe, winget.exe, or msiexec.exe) and the file age is less than 7 days.CI/CD Pipeline Build Artifacts: A DevOps pipeline compiles a microservice and generates a temporary executable or JAR file with a name matching the AdaptixC2 IOC (e.g., adaptix-c2-build.tmp or a specific SHA256) during the integration testing phase on a build agent. This is a transient artifact that is deleted after the build completes.
build, artifacts, or temp directories (e.g., C:\builds\, D:\artifacts\) and the process is initiated by a CI/CD runner (e.g., jenkins.exe, gitlab-runner, or azure-pipelines-agent).Third-Party Security Scanner Quarantine: A vulnerability scanner (e.g., Tenable, Qualys, or Rapid7 InsightVM) downloads a sample or test binary to verify a CVE, and the file hash matches the AdaptixC2 IOC because the scanner uses a known test payload. The file is typically isolated in a quarantine folder and not executed by user processes.