The Gentlemen RaaS & AdaptixC2 Framework: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Potential SystemBC Proxy Installation
id: 6a4b3c2d-1e5f-4a8b-9c6d-7e8f0a1b2c3d
description: Detects potential installation of SystemBC proxy malware, which is frequently used by The Gentlemen ransomware gang for covert tunneling
author: Security Arsenal
date: 2026/04/20
references:
    - https://otx.alienvault.com/pulse/662291653e07e0b3143d9d6c/
tags:
    - attack.command_and_control
    - attack.t1071
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\cmd.exe' or ParentImage|endswith: '\powershell.exe'
        CommandLine|contains|all:
            - 'regsvr32.exe'
            - '/s'
            - '/i'
        CommandLine|contains:
            - 'http://'
            - 'scrobj.dll'
    condition: selection
falsepositives:
    - Legitimate administrative tasks
level: high
---
title: Suspicious AdaptixC2 Framework Activity
id: 5d4c3b2a-0f4e-3d7a-8b5c-6d7e0a1b2c3d
description: Detects potential AdaptixC2 framework activity, a post-exploitation tool increasingly used by APT groups and ransomware operators
author: Security Arsenal
date: 2026/04/20
references:
    - https://otx.alienvault.com/pulse/6622f6653e07e0b3143d9d6c/
tags:
    - attack.execution
    - attack.t1059
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\powershell.exe'
        CommandLine|contains|all:
            - 'New-Object'
            - 'System.Net.Sockets.TCPClient'
            - 'GetStream'
            - 'Read'
    condition: selection
falsepositives:
    - Legitimate PowerShell network operations
level: medium
---
title: The Gentlemen Ransomware Activity Pattern
id: 4e3d2c1b-9f3d-2c6a-7b4a-5c6d0e1f2a3b
description: Detects activity patterns associated with The Gentlemen ransomware gang, including their use of SystemBC, Cobalt Strike, and AnyDesk
author: Security Arsenal
date: 2026/04/20
references:
    - https://otx.alienvault.com/pulse/662291653e07e0b3143d9d6c/
    - https://otx.alienvault.com/pulse/6622917f3e07e0b3143d9d6c/
tags:
    - attack.impact
    - attack.t1486
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    selection_anydesk:
        Image|endswith: '\anydesk.exe'
        CommandLine|contains: 'start'
    selection_psexec:
        Image|endswith: '\psexec.exe'
        CommandLine|contains: '-accepteula'
    selection_cobaltstrike:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
        CommandLine|contains:
            - 'DownloadString'
            - 'IEX'
    condition: 1 of selection_*
falsepositives:
    - Authorized remote administration tools
level: high


kql
// Hunt for SystemBC network connections
DeviceNetworkEvents
| where RemotePort in (443, 8080, 8888, 53)
| where InitiatingProcessFileName in ("powershell.exe", "cmd.exe", "regsvr32.exe")
| where NetworkConnectionStatus == "Established"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| order by Timestamp desc

// Search for AdaptixC2 related processes
DeviceProcessEvents
| where ProcessCommandLine has "New-Object" and ProcessCommandLine has "System.Net.Sockets.TCPClient"
| where ProcessCommandLine has "GetStream" or ProcessCommandLine has "Read"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

// Hunt for The Gentlemen related tool usage
DeviceProcessEvents
| where FileName in~ ("anydesk.exe", "psexec.exe") 
| where ProcessCommandLine has "-accepteula" or ProcessCommandLine has "start"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc


powershell
# The Gentlemen IOC Hunt Script
# Check for SystemBC artifacts
$systembcPaths = @(
    "$env:TEMP\scrobj.dll",
    "$env:APPDATA\SystemBC",
    "$env:LOCALAPPDATA\SystemBC"
)

foreach ($path in $systembcPaths) {
    if (Test-Path $path) {
        Write-Host "ALERT: Potential SystemBC artifact found at $path"
        $fileHash = Get-FileHash -Path $path -Algorithm SHA256
        Write-Host "File Hash: $($fileHash.Hash)"
    }
}

# Check for SystemBC scheduled tasks
$scheduledTasks = Get-ScheduledTask | Where-Object { $_.Actions.Execute -like "*SystemBC*" -or $_.Actions.WorkingDirectory -like "*SystemBC*" }
if ($scheduledTasks) {
    Write-Host "ALERT: Potential SystemBC scheduled tasks found:"
    $scheduledTasks | ForEach-Object { 
        Write-Host "Task Name: $($_.TaskName)"
        Write-Host "Task Path: $($_.TaskPath)"
    }
}

# Check for AdaptixC2 indicators
$adaptixRegistryPaths = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdaptixC2",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdaptixC2"
)

foreach ($regPath in $adaptixRegistryPaths) {
    if (Test-Path $regPath) {
        Write-Host "ALERT: Potential AdaptixC2 persistence mechanism found at $regPath"
        Get-ItemProperty -Path $regPath
    }
}

# Check for unusual network connections (SystemBC typically uses specific ports)
$netstatOutput = netstat -ano | Select-String "ESTABLISHED"
$systembcPorts = @(443, 8080, 8888, 53, 80)
$suspiciousConnections = $netstatOutput | Where-Object { 
    $line = $_.ToString().Split(' ', [StringSplitOptions]::RemoveEmptyEntries)
    $localAddress = $line[1]
    $localPort = $localAddress.Split(':')[-1]
    $systembcPorts -contains [int]$localPort
}

if ($suspiciousConnections) {
    Write-Host "ALERT: Potential SystemBC network connections detected:"
    $suspiciousConnections
}