Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,040 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects high volumes of authentication failures (AADSTS50034) targeting non-existent or invalid usernames from a single source IP address, potentially indicating account enumeration or password spraying activity.
Detects multiple authentication failure attempts (error code 700016: Application not found in directory) originating from the same IP address against multiple user accounts. This pattern is indicative of an adversary attempting to find or exploit service principals or misconfigured applications across the tenant.
Detects login attempts using an Outlook/Office-specific User-Agent string where the application being accessed does not match common Microsoft 365 services (Outlook, Office, Exchange, Teams, OneDrive, SharePoint, ActiveSync, or Skype). This pattern is often indicative of programmatic attempts to bypass or spoof standard application signatures during credential stuffing or brute force campaigns.
Detects sequential HTTP GET requests for specific SVG assets (barr.svg followed by lg.svg) associated with the Kratos V1 phishing kit landing page, indicating potential interaction with a phishing site.
Detects execution/staging of the GodDamn ransomware encrypter binary encrypter-windows-gui-x86.exe from user profile Downloads or Music folders, or matching the known encrypter hash
Detects a process creating files named 'README.TXT' or 'README.txt' across three or more distinct directories. This behavior is a common indicator of ransomware activity, where an adversary drops ransom notes in multiple folders to maximize visibility after encrypting files.
Detects Blind Eagle JC-46 AsyncRAT process-injection/hollowing pivot: wscript.exe,
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
This rule detects network traffic originating from the internal network directed towards a hardcoded IP address associated with the CrashStealer malware. The rule flags outbound traffic to this specific destination, which is indicative of command and control communication or data exfiltration.
Detects the creation or modification of a file at a specific Launch Agent path commonly used for macOS persistence. Attackers often place property list (.plist) files in /Library/LaunchAgents/ to achieve persistence across system reboots or user logons.
Detects the use of shell interpreters (sh, bash, zsh) to download content from GitHub using curl (specifically using the -s silent flag) and subsequent base64 decoding of potentially obfuscated payloads using the base64 command with the -D flag.
Page 162 of 249