AdaptixC2 AdgNsy.exe Deployed via WMI with WAB.EXE Injection

Ibrahim Saud@tektrix

•updated Jun 29, 2026•1•0•4

Detects the execution of the suspicious binary 'AdgNsy.exe', including scenarios where it is spawned by the WMI Provider Host (WmiPrvSE.exe). This pattern is often associated with malicious activity, including potential persistence mechanisms or arbitrary code execution via WMI event subscriptions.