This hunt targets the presence of seven known IOCs associated with the AdaptixC2 command-and-control framework, which adversaries use to establish persistent remote access and execute malicious payloads. Proactively hunting for these indicators in Azure Sentinel is critical to identify compromised endpoints or infrastructure before the threat actor can leverage the C2 channel for lateral movement, data exfiltration, or further payload delivery.
Malware Family: AdaptixC2 Total IOCs: 7 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 43[.]198[.]116[.]85:4321 | botnet_cc | 2026-09-09 | 75% |
| ip:port | 43[.]143[.]57[.]45:4321 | botnet_cc | 2026-09-09 | 75% |
| ip:port | 182[.]92[.]227[.]226:4321 | botnet_cc | 2026-09-09 | 75% |
| ip:port | 171[.]113[.]115[.]5:8001 | botnet_cc | 2026-09-09 | 75% |
| ip:port | 154[.]37[.]218[.]235:4321 | botnet_cc | 2026-09-09 | 75% |
| ip:port | 153[.]142[.]13[.]183:4321 | botnet_cc | 2026-09-09 | 75% |
| ip:port | 144[.]172[.]118[.]114:51956 | botnet_cc | 2026-09-09 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["153.142.13.183", "171.113.115.5", "154.37.218.235", "43.143.57.45", "144.172.118.114", "182.92.227.226", "43.198.116.85"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["153.142.13.183", "171.113.115.5", "154.37.218.235", "43.143.57.45", "144.172.118.114", "182.92.227.226", "43.198.116.85"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Legitimate Web Application Deployment: Developers deploying new microservices or containerized applications may use adaptix or similar naming conventions for internal build artifacts, configuration files, or temporary directories during CI/CD pipeline executions.
C:\Jenkins\workspace\, /var/lib/jenkins/, D:\AzureDevOps\) and exclude file extensions associated with build outputs (e.g., .jar, .war, .dll, .so) unless the IOC specifically targets executable binaries.Internal Tooling and Scripting: IT operations teams may create custom PowerShell or Bash scripts for infrastructure automation that reference adaptix as a module name, variable prefix, or log tag for adaptive indexing or data processing tasks.
powershell.exe launched by Task Scheduler with parent svchost.exe or explorer.exe from admin workstations) and filter out file paths containing scripts\, tools\, or automation\ directories.Third-Party Vendor Agents: Certain enterprise monitoring or backup agents (e.g., from vendors like Veeam, Commvault, or internal security tools) may include components or temporary files named adaptix or similar variants during updates or snapshot operations.
C:\Program Files\Veeam\, C:\Program Files\Commvault\) and exclude events where the parent process is a known vendor service executable (e.g., VeeamBackup.exe, cvbackup.exe).Development Environments and IDEs: Developers using IDEs (e.g., Visual Studio, IntelliJ) or