Jason T
@swdetectCompletionist
1 follower44 downloads8 copies0 likes1,067 views
4 detections
Filters
Last updated
All Time
Detection languages
4
Categories
3
1
1
1
1
Platforms
3
1
Products / Services
1
1
1
1
MITRE Techniques
4
3
1
1
1
Detects a specific combination of HTTP GET, POST, and PUT requests to the GitHub API (api.github.com) within a short timeframe. This sequence matches the behavior of the AdaptixC2 custom listener used by Tropic Trooper, which uses GitHub issues for beaconing/task polling and the contents API for data exfiltration. The detection has been refined to look for specific AdaptixC2 operational keywords ('beat', 'upload', 'download') to reduce noise.
Detects the use of the curl utility to download files from bashupload.app, an anonymous file-sharing service. This behavior was observed in Tropic Trooper campaigns to stage payloads and tools during post-exploitation.
Detects the creation of a scheduled task executing binaries or scripts from the \Users\Public\ directory. This behavior has been observed in Tropic Trooper campaigns to maintain persistence and execute malicious payloads via the AdaptixC2 agent, but applies broadly to threat actors staging in the Public folder.
Detects the command line execution of VS Code initiating a remote tunnel. Threat actors like Tropic Trooper use this technique (e.g., via GitHub or Microsoft providers) to establish interactive remote access while blending in with legitimate developer activity.