SigmaHQ/rules/windows/process_creation/win_apt_tropictrooper.yml

title: TropicTrooper Campaign November 2018
id: 8c7090c3-e0a0-4944-bd08-08c3a0cecf79
author: '@41thexplorer, Microsoft Defender ATP'
status: stable
date: 2019/11/12
description: Detects TropicTrooper activity, an actor who targeted high-profile organizations in the energy and food and beverage sectors in Asia
references:
    - https://cloudblogs.microsoft.com/microsoftsecure/2018/11/28/windows-defender-atp-device-risk-score-exposes-new-cyberattack-drives-conditional-access-to-protect-networks/
tags:
    - attack.execution
    - attack.t1085
    - attack.t1218.011
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine: '*abCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCc*'
    condition: selection
level: high
Unified line terminators of rules to Unix 2019-11-12 22:05:36 +00:00			`title: TropicTrooper Campaign November 2018`
Added UUIDs to rules 2019-11-12 22:12:27 +00:00			`id: 8c7090c3-e0a0-4944-bd08-08c3a0cecf79`
MDATP schema changes WDATP was renamed to MDATP (Microsoft Defendre ATP). MDATP also had schema changes recently: https://techcommunity.microsoft.com/t5/microsoft-defender-atp/advanced-hunting-data-schema-changes/ba-p/1043914 The updates reflect these changes 2020-03-09 16:12:41 +00:00			`author: '@41thexplorer, Microsoft Defender ATP'`
Unified line terminators of rules to Unix 2019-11-12 22:05:36 +00:00			`status: stable`
fix: fixed missing date fields in other files 2020-01-30 14:32:39 +00:00			`date: 2019/11/12`
Unified line terminators of rules to Unix 2019-11-12 22:05:36 +00:00			`description: Detects TropicTrooper activity, an actor who targeted high-profile organizations in the energy and food and beverage sectors in Asia`
			`references:`
			`- https://cloudblogs.microsoft.com/microsoftsecure/2018/11/28/windows-defender-atp-device-risk-score-exposes-new-cyberattack-drives-conditional-access-to-protect-networks/`
			`tags:`
			`- attack.execution`
			`- attack.t1085`
Initial round of subtechnique updates 2020-06-16 20:46:08 +00:00			`- attack.t1218.011`
Unified line terminators of rules to Unix 2019-11-12 22:05:36 +00:00			`logsource:`
			`category: process_creation`
			`product: windows`
			`detection:`
			`selection:`
			`CommandLine: 'abCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCc'`
			`condition: selection`
fix: fixed missing date fields in other files 2020-01-30 14:32:39 +00:00			`level: high`