Adversaries using AdaptixC2 are likely establishing command and control communication through suspicious network traffic patterns associated with the detected IOCs. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential compromise from advanced persistent threats leveraging AdaptixC2.
IOC Summary
Malware Family: AdaptixC2 Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 88[.]119[.]167[.]143:8000 | botnet_cc | 2026-05-22 | 75% |
| ip:port | 172[.]86[.]123[.]119:8679 | botnet_cc | 2026-05-22 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["88.119.167.143", "172.86.123.119"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["88.119.167.143", "172.86.123.119"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: Legitimate scheduled job running hunting.exe as part of a security tool’s routine IOC analysis
Filter/Exclusion: process.name != "hunting.exe" or process.parent.name == "security_tool.exe"
Scenario: System administrator using adaptix.exe as a custom script to parse threat intelligence data
Filter/Exclusion: process.name != "adaptix.exe" or user.name == "admin"
Scenario: Regular execution of a backup job that uses adaptix_c2.exe for file integrity monitoring
Filter/Exclusion: process.name != "adaptix_c2.exe" or process.parent.name == "backup_service.exe"
Scenario: Use of adaptix_c2.exe by a legitimate threat intelligence platform for IOC lookup
Filter/Exclusion: process.name != "adaptix_c2.exe" or process.parent.name == "threat_intel_platform.exe"
Scenario: Internal tool adaptix_hunt.exe used by SOC team for manual IOC verification
Filter/Exclusion: process.name != "adaptix_hunt.exe" or user.name == "soc_team"