Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
5
2
1
Contributors
4
2
1
1
Categories
5
4
2
2
1
Platforms
6
2
Products / Services
1
1
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects a specific combination of HTTP GET, POST, and PUT requests to the GitHub API (api.github.com) within a short timeframe. This sequence matches the behavior of the AdaptixC2 custom listener used by Tropic Trooper, which uses GitHub issues for beaconing/task polling and the contents API for data exfiltration. The detection has been refined to look for specific AdaptixC2 operational keywords ('beat', 'upload', 'download') to reduce noise.
Detects the command line execution of VS Code initiating a tunnel using a GitHub provider. This technique has been observed to be used by threat actors like Tropic Trooper to establish interactive remote access while blending in with legitimate developer activity.
Detects the use of the curl utility to download files from bashupload.app, an anonymous file-sharing service. This behavior was observed in Tropic Trooper campaigns to stage payloads and tools during post-exploitation.
Detects the creation of a scheduled task executing binaries or scripts from the \Users\Public\ directory. This behavior has been observed in Tropic Trooper campaigns to maintain persistence and execute malicious payloads via the AdaptixC2 agent, but applies broadly to threat actors staging in the Public folder.
Detects the command line execution of VS Code initiating a remote tunnel. Threat actors like Tropic Trooper use this technique (e.g., via GitHub or Microsoft providers) to establish interactive remote access while blending in with legitimate developer activity.
Detects network connections, DNS requests, and HTTP traffic to known Tropic Trooper C2 infrastructure, indicating potential AdaptixC2 or Cobalt Strike beaconing from compromised endpoints.
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_tropictrooper.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
Detects activity associated with the Tropic Trooper campaign from November 2018, specifically looking for a distinct command-line string used by the threat actor. This rule targets a specific pattern in process command lines that indicates the execution of malicious code or scripts by Tropic Trooper, an actor known for targeting organizations in the energy and food and beverage sectors in Asia.
