This hunt targets the presence of known AdaptixC2 indicators of compromise to identify potential command-and-control infrastructure or compromised assets within the environment. Proactively hunting for these IOCs is critical because AdaptixC2 is a high-severity threat often used for persistent access, allowing the SOC to detect and isolate adversaries before they can establish a foothold or execute further malicious actions.
Malware Family: AdaptixC2 Total IOCs: 6 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 69[.]48[.]229[.]91:8080 | botnet_cc | 2026-09-15 | 100% |
| ip:port | 69[.]48[.]229[.]91:80 | botnet_cc | 2026-09-15 | 100% |
| ip:port | 69[.]48[.]229[.]91:443 | botnet_cc | 2026-09-15 | 100% |
| ip:port | 69[.]48[.]229[.]91:9443 | botnet_cc | 2026-09-15 | 100% |
| ip:port | 38[.]54[.]88[.]188:65432 | botnet_cc | 2026-09-15 | 75% |
| ip:port | 185[.]164[.]57[.]60:4999 | botnet_cc | 2026-09-15 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["69.48.229.91", "38.54.88.188", "185.164.57.60"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["69.48.229.91", "38.54.88.188", "185.164.57.60"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., Jenkins or GitHub Actions) to deploy a new microservice version. The deployment script pulls a container image from a private registry or downloads a build artifact from a temporary S3 bucket that shares the same IP or domain hash as an AdaptixC2 IOC, often because the artifact was cached or mirrored from a public source during the build process.
svc-jenkins, github-actions-runner) or specific internal subnets dedicated to build infrastructure (e.g., 10.20.0.0/24).Scenario: An IT administrator performs a standard software update using a package manager like apt-get or yum on a Linux server. The update fetches a dependency package (e.g., a specific version of libssl or zlib) from a public mirror that happens to match one of the AdaptixC2 IOCs due to a shared CDN or temporary hosting location used by the upstream maintainer.
apt, yum, dnf, pacman) and the destination path is within standard system library directories (e.g., /usr/lib/, /usr/local/lib/).Scenario: A security team runs a scheduled vulnerability scan or integrity check using a tool like Nessus or Qualys. The scanner downloads a plugin or signature update from a vendor’s update server, which may be hosted on a shared infrastructure IP that coincidentally matches an AdaptixC2 IOC, especially if the vendor uses a common cloud provider or CDN.