This hunt targets known indicators of compromise for the AdaptixC2 framework, a tool frequently used by threat actors to establish persistent command-and-control channels and execute remote code execution. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised assets early, preventing adversaries from leveraging the framework for lateral movement or data exfiltration before they escalate privileges.
Malware Family: AdaptixC2 Total IOCs: 5 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 101[.]42[.]33[.]156:443 | botnet_cc | 2026-09-20 | 75% |
| ip:port | 45[.]76[.]0[.]96:8080 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 45[.]76[.]0[.]96:80 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 68[.]64[.]177[.]24:80 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 68[.]64[.]177[.]24:443 | botnet_cc | 2026-09-19 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AdaptixC2
let malicious_ips = dynamic(["68.64.177.24", "45.76.0.96", "101.42.33.156"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["68.64.177.24", "45.76.0.96", "101.42.33.156"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
AdaptixC2 hash or domain as part of its update mechanism or telemetry endpoint.
C:\Program Files\LegacyERP\bin\) or the known service account used by the ERP scheduler.datadog-agent.exe, newrelic-agent.exe).C:\Users\<dev>\Projects\, C:\docker\, or C:\VMs\) or where the parent process is a known container runtime (e.g., docker.exe, hyper-v.exe, vmware-vmx.exe).