Windows: Command-line contains long ab-prefixed string seen in TropicTrooper activity (Nov 2018)

Detects Windows processes whose command line contains a known TropicTrooper campaign indicator string.

FreeReviewedSigma · High · v5

Product: windows
Category: process_creation
Author: @41thexplorer, Microsoft Defender ATP (SigmaHQ), DRL 1.1
Published: 2019-11-12
Updated: 2026-07-31

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches Windows process creation events where the command line contains a specific long string beginning with "ab". Such exact command-line patterns can indicate scripted or staged execution used during targeted intrusions. The detection relies on process creation telemetry with access to the full command line.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Suspicious Node.js Spawning Script Interpreter for Dropped Payload

Suspicious PowerShell Remote Download and Execution via Invoke-WebRequest

Suspicious Script Host Spawning Hidden PowerShell (via process_creation)

Suspicious PowerShell Reflective Assembly Load With GZip Decompression (via process_creation)

Suspicious PowerShell Invoke-Expression with Replace Obfuscation

Suspicious PowerShell Archive Extraction to AppData Roaming

Malicious PowerShell Spawned by Masqueraded NVIDIA GeForce Experience Binary

Suspicious PowerShell Hidden Unrestricted Execution via ClickFix

Suspicious PowerShell Spawned by cscript in Script Chain

Windows: Command-line contains long ab-prefixed string seen in TropicTrooper activity (Nov 2018)

Pivot detection · T1059.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-commandline-match-for-tropictrooper-campaign-indicators-8c7090c3

title: "Windows: Command-line contains long ab-prefixed string seen in TropicTrooper activity (Nov 2018)"
id: 5beaad38-5845-4a11-a34b-7f1fd6362159
status: stable
description: This rule matches Windows process creation events where the command line contains a specific long string beginning with "ab". Such exact command-line patterns can indicate scripted or staged execution used during targeted intrusions. The detection relies on process creation telemetry with access to the full command line.
references:
  - https://www.microsoft.com/en-us/security/blog/2018/11/28/windows-defender-atp-device-risk-score-exposes-new-cyberattack-drives-conditional-access-to-protect-networks/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/TA/TropicTrooper/proc_creation_win_apt_tropictrooper.yml
author: "@41thexplorer, Microsoft Defender ATP, Huntrule Team"
date: 2019-11-12
modified: 2020-08-27
tags:
  - attack.execution
  - attack.t1059.001
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: abCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCc
  condition: selection
level: high
license: DRL-1.1
related:
  - id: 8c7090c3-e0a0-4944-bd08-08c3a0cecf79
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL