This hunt targets known indicators of compromise associated with the AdaptixC2 framework to identify potential command-and-control infrastructure or malicious endpoints within the environment. Proactively hunting for these IOCs allows the SOC to detect early-stage adversary activity and establish a foothold before the threat actor can fully execute their post-exploitation objectives.
Malware Family: AdaptixC2 Total IOCs: 3 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 162[.]35[.]172[.]146:8080 | botnet_cc | 2026-09-13 | 100% |
| ip:port | 162[.]35[.]172[.]146:443 | botnet_cc | 2026-09-13 | 100% |
| ip:port | 162[.]35[.]172[.]146:80 | botnet_cc | 2026-09-13 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["162.35.172.146"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc
// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["162.35.172.146"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
C:\dev\cobaltstrike\, C:\tools\sliver\) or exclude hosts tagged with dev-test or lab in CMDB/asset management.Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36). If the IOC relies on User-Agent or specific header combinations, these routine jobs can cause false positives.
vssadmin.exe, python.exe, node.exe) and exclude if the parent process is in a known allowlist of backup/sync tools.net/http, Python’s requests) that generate user-agent or header patterns identical to the AdaptixC2 IOC. If the IOC is based on static header values rather than dynamic behavioral analysis, internal east-west traffic can trigger