This hypothesis targets the presence of known AdaptixC2 command-and-control infrastructure, indicating that an adversary may be actively managing compromised assets or exfiltrating data through this specific framework. Proactively hunting for these IOCs in Azure Sentinel is critical because AdaptixC2 is a high-severity threat often used for persistent access, allowing the SOC to identify and isolate compromised endpoints before the attacker can escalate privileges or move laterally within the environment.
Malware Family: AdaptixC2 Total IOCs: 5 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 45[.]202[.]1[.]16:14501 | botnet_cc | 2026-09-21 | 75% |
| ip:port | 23[.]158[.]24[.]65:4321 | botnet_cc | 2026-09-21 | 75% |
| ip:port | 114[.]132[.]190[.]121:8080 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 114[.]132[.]190[.]121:80 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 114[.]132[.]190[.]121:443 | botnet_cc | 2026-09-21 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["114.132.190.121", "23.158.24.65", "45.202.1.16"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["114.132.190.121", "23.158.24.65", "45.202.1.16"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Adaptive DNS Resolution for Internal Microservices: In environments using Kubernetes or Service Meshes (e.g., Istio), sidecar proxies or application containers may dynamically resolve internal service names that happen to match the specific domain suffixes or IP ranges in the AdaptixC2 IOC list. This is common in multi-tenant cloud environments where internal DNS zones are not strictly segregated from public threat intelligence feeds.
containerd, crio) or a service mesh sidecar (e.g., envoy, istio-proxy) and the destination IP is within the internal RFC1918 range or a known internal DNS cluster IP.Legacy Application Updates via Specific Vendor Endpoints: Some older enterprise applications (e.g., legacy Java-based middleware or specific SCADA HMI software) may check for updates or license validation against specific vendor domains or IP addresses that overlap with the AdaptixC2 IOCs. These checks are typically initiated by scheduled tasks or service startup routines.
*.vendor-update.com) and exclude alerts where the initiating process is a known service executable (e.g., service.exe, update_agent.exe) and the connection occurs during a defined maintenance window or scheduled job execution.Development and Testing Environments: Developers and QA engineers often use local proxy tools (e.g., mitmproxy, Charles Proxy, or Fiddler) or test harnesses that may intercept or route traffic through specific IP ranges or domains listed in the IOC set. These tools are frequently run on developer workstations or CI/CD build agents.
Developer or QA or from machines