AdaptixC2 Agent: WmiPrvSE AppData Spawn, AdgNsy.exe, and Non-Standard Port C2

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

Detects execution of the AdaptixC2 agent (AdgNsy.exe), anomalous WMI lateral movement (WmiPrvSE.exe spawning processes from AppData\Local), and suspicious outbound network connections from AppData\Local processes to non-standard ports.