Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,036 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects instances where rundll32.exe, likely used by the TELEPUZ threat actor, performs a direct file read of ntdll.dll from standard Windows system directories. This behavior is indicative of an attempt to obtain an unhooked copy of ntdll.dll to overwrite the in-memory, hooked version, thereby evading security monitoring.
Detects PowerShell execution initiating WMI queries to gather information about antivirus products, network adapter configurations, or User Account Control (UAC) policy settings. This behavior is indicative of system and defensive environment reconnaissance.
Detects Microsoft Entra ID authentication failures (AADSTS700016) where a client ID is provided that does not exist in the directory. This error often indicates attackers attempting to spoof legitimate OAuth client applications to perform reconnaissance or bypass conditional access policies.
Detects the execution of PowerShell scripts or commands related to the 'Invoke-ClientIdSpoofEnum' tool, which is used for OAuth client ID spoofing. This technique allows attackers to bypass security controls by enumerating valid client IDs within Microsoft Entra environments, potentially leading to unauthorized token requests.
This rule detects potential user enumeration attacks targeting Entra ID tenants by monitoring for failed sign-in attempts (ResultType 50034) involving common, predictable username patterns across multiple tenants within a 24-hour window. This behavior often indicates an adversary attempting to map valid usernames by exploiting error code differences or identity discovery patterns.
This rule detects the presence of Remcos Remote Access Trojan (RAT) by matching known malware family signatures identified by antivirus software. Remcos RAT is frequently used by adversaries for unauthorized system control, data exfiltration, and surveillance.
Detects the loading of a potentially malicious DLL (WinUpdateHelper.dll) by a process masquerading as or identified as a GTA 5 Online mod menu. This behavior is indicative of DLL injection or side-loading techniques used by gaming cheats/malware to maintain execution context.
Detects Microsoft Entra ID authentication attempts (Resource Owner Password Credentials - ROPC) where the Client ID and Application Display Name are blank. This pattern is indicative of attackers attempting to enumerate users or bypass security controls by using malformed or spoofed client identification in authentication requests.
This rule detects two suspicious patterns: 1) Using the sc.exe utility to create a new Windows service configured to start at boot, often used for persistence or to execute malicious payloads with system privileges. 2) The execution of PowerShell.exe directly by the service control manager (services.exe), which is highly atypical for normal system operations and often indicates malicious script execution initiated as a service.
Detects the execution of the 's5cmd' tool from the 'C:\ProgramData' directory. 's5cmd' is a common command-line tool used for interacting with object storage systems like Amazon S3 and is frequently leveraged by attackers for data exfiltration due to its efficiency.
Page 164 of 249