This hunt targets known indicators of compromise associated with the AdaptixC2 framework, which adversaries use to establish persistent command-and-control channels for data exfiltration and remote execution. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised assets early, as the high severity of this threat underscores the risk of undetected lateral movement and privilege escalation within the environment.
Malware Family: AdaptixC2 Total IOCs: 3 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 45[.]207[.]211[.]207:4322 | botnet_cc | 2026-09-24 | 75% |
| ip:port | 39[.]105[.]16[.]200:4321 | botnet_cc | 2026-09-24 | 75% |
| ip:port | 2[.]27[.]160[.]141:61712 | botnet_cc | 2026-09-24 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["2.27.160.141", "45.207.211.207", "39.105.16.200"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["2.27.160.141", "45.207.211.207", "39.105.16.200"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses a custom Python script or PowerShell one-liner to perform automated network connectivity checks (e.g., Test-NetConnection or curl) against a specific AdaptixC2 IP address to verify firewall rules or service availability before a deployment.
C:\DevOps\scripts\, C:\Users\<admin>\AppData\Local\Temp\) or exclude parent processes like python.exe, pwsh.exe, or powershell.exe when the remote IP matches a known internal staging or test subnet range.Scenario: An IT administrator runs a scheduled task or a manual command to test DNS resolution or HTTP headers against the AdaptixC2 domain (e.g., nslookup or curl -I) as part of a routine health check for a newly provisioned service or to validate a DNS override in a test environment.
nslookup, dig, curl, or Test-NetConnection in the command line arguments, or exclude events where the initiating user account belongs to a specific “Service Account” or “Admin” security group.Scenario: A security team or SOC analyst is actively testing the detection rule itself or investigating a suspected incident by intentionally connecting to the AdaptixC2 IOCs using tools like nmap, masscan, or a browser to confirm the rule fires correctly.
nmap.exe, masscan.exe, browser.exe with a specific user agent) or where the user account is tagged with a “SOC Analyst” or “Detection Test” attribute in the identity provider.