Detect AdaptixC2 Framework DoH and Associated TTPs
Detects AdaptixC2 framework behaviors by correlating DNS over HTTPS (DoH) lookups to known providers (dns.google, dns.quad9) with subsequent Beacon Object File (BOF) activities. It specifically looks for the same process performing the DoH lookup and subsequently executing LSASS dumping commands, spawning sacrificial BOF processes, or initiating SMB/WinRM lateral movement.
CQL
