This rule detects potential compromise by AdaptixC2, a command-and-control framework often used by threat actors to establish persistent access and exfiltrate data. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate affected assets before the adversary can leverage the C2 channel for lateral movement or further payload delivery.
Malware Family: AdaptixC2 Total IOCs: 3 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 8[.]137[.]111[.]232:4321 | botnet_cc | 2026-09-23 | 75% |
| ip:port | 47[.]243[.]96[.]54:4322 | botnet_cc | 2026-09-23 | 75% |
| ip:port | 120[.]27[.]155[.]171:50010 | botnet_cc | 2026-09-23 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["47.243.96.54", "120.27.155.171", "8.137.111.232"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["47.243.96.54", "120.27.155.171", "8.137.111.232"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps team deploys a new microservice using a container image built from a base layer that includes a specific version of libcurl or a network utility library known to have a static hash collision with one of the AdaptixC2 IOCs. The service runs on a standard Kubernetes node or VM where the library is loaded during the application startup process.
C:\Windows\System32\, /usr/lib/, or /opt/app/lib/) and the parent process is a known container runtime (e.g., dockerd, containerd, kubelet) or a standard application server (e.g., java, node, python3).Scenario: An IT administrator performs a routine patching cycle using a proprietary internal tool (e.g., PatchManager.exe or a custom UpdateService.dll) that was compiled with a specific compiler version, resulting in a binary hash that matches one of the AdaptixC2 IOCs due to a rare build configuration overlap. The tool is executed from a shared administrative share (\\fileserver\admins\tools\) by multiple admin accounts.
\\fileserver\admins\, \\admin-tools\) and the user account belongs to the Domain Admins or IT_Ops security group, provided the process is not running from a user-writable directory like C:\Users\<user>\Downloads\.Scenario: A security team runs a scheduled vulnerability scan using a tool like Nessus or Qualys agent that includes a custom plugin or helper binary (e.g., qagent_helper.dll) developed in-house. This binary has a static