This hunt targets known indicators of compromise associated with the AdaptixC2 framework, which adversaries use to establish covert command-and-control channels for data exfiltration and remote execution. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised assets early, preventing the AdaptixC2 implant from achieving persistence or escalating privileges within the environment.
Malware Family: AdaptixC2 Total IOCs: 3 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 89[.]124[.]108[.]211:4321 | botnet_cc | 2026-09-11 | 75% |
| ip:port | 78[.]17[.]93[.]96:4321 | botnet_cc | 2026-09-11 | 75% |
| ip:port | 45[.]13[.]239[.]249:4321 | botnet_cc | 2026-09-11 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["78.17.93.96", "89.124.108.211", "45.13.239.249"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["78.17.93.96", "89.124.108.211", "45.13.239.249"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Adaptive Load Balancing and CDN Configuration: In environments using adaptive load balancers (e.g., AWS ALB, Azure Front Door) or CDN services (e.g., Cloudflare, Akamai), legitimate traffic patterns may mimic the specific connection intervals or payload structures of AdaptixC2. The “Adaptix” name suggests adaptive behavior, which aligns with how modern CDNs dynamically adjust routing based on latency or health checks.
104.16.0.0/12 for Cloudflare, 192.0.2.0/24 for Akamai) or specific service tags like aws:alb and azure:frontdoor in the firewall or proxy logs.Automated Health Check and Monitoring Agents: Enterprise monitoring tools such as Datadog, New Relic, or custom Python/Go-based health check scripts often perform periodic, low-volume HTTP requests to verify service availability. If these checks use specific User-Agents or path structures that overlap with AdaptixC2 IOCs, they can trigger false positives.
monitoring-agent, health-check, or specific service accounts like svc-datadog or svc-newrelic. Additionally, filter out requests to known internal health endpoints (e.g., /health, /status, /ping) if the IOC is path-based.CI/CD Pipeline Artifact Downloading: In DevOps environments, build agents (e.g., Jenkins, GitLab CI, Azure DevOps) frequently download artifacts, dependencies, or container images from internal registries or external CDNs. If the download mechanism uses a generic HTTP client or specific TLS fingerprints that match AdaptixC2 IOCs, the build process can