Windows Process Creation CommandLine Match for TropicTrooper Campaign Indicators (Nov 2018)

Detects Windows processes whose command line contains a known TropicTrooper campaign indicator string.

FreeUnreviewedSigmahighv1

windows-process-creation-commandline-match-for-tropictrooper-campaign-indicators-8c7090c3

title: Windows Process Creation CommandLine Match for TropicTrooper Campaign Indicators (Nov 2018)
id: 5beaad38-5845-4a11-a34b-7f1fd6362159
status: stable
description: This rule flags Windows process creation events where the process command line contains a specific long-character indicator associated with the TropicTrooper campaign from November 2018. Attackers may use command lines to execute malicious activity or stages of an intrusion, making exact string matches useful for high-confidence identification when the indicator is present. The detection relies on process_creation telemetry with access to the full command line.
references:
  - https://www.microsoft.com/en-us/security/blog/2018/11/28/windows-defender-atp-device-risk-score-exposes-new-cyberattack-drives-conditional-access-to-protect-networks/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/TA/TropicTrooper/proc_creation_win_apt_tropictrooper.yml
author: "@41thexplorer, Microsoft Defender ATP, Huntrule Team"
date: 2019-11-12
modified: 2020-08-27
tags:
  - attack.execution
  - attack.t1059.001
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: abCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCc
  condition: selection
level: high
license: DRL-1.1
related:
  - id: 8c7090c3-e0a0-4944-bd08-08c3a0cecf79
    type: derived

What it detects

This rule flags Windows process creation events where the process command line contains a specific long-character indicator associated with the TropicTrooper campaign from November 2018. Attackers may use command lines to execute malicious activity or stages of an intrusion, making exact string matches useful for high-confidence identification when the indicator is present. The detection relies on process_creation telemetry with access to the full command line.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.