Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,036 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects known WinUpdateHelper.dll malicious variants by SHA256 hash, side-loaded to initiate infection across 17 kill chains
Detects co-occurrence of Kratos phishing kit static asset filenames lg.svg, barr.svg, ani.gif, and styles.css served from phishing infrastructure
Detects instances where a user receives an email containing a link to 'canva.com' with subject lines suggestive of document sharing or invoicing, and subsequently clicks a URL that redirects them away from the 'canva.com' domain. This behavior is indicative of potential document-based phishing where attackers use legitimate document hosting platforms as a lure to redirect users to malicious or credential-harvesting websites.
This rule identifies network traffic utilizing the WebSocket (wss://) protocol. WebSockets are commonly used for real-time web communications, but adversaries may also use them to establish C2 channels or tunnel traffic to bypass security controls by blending in with standard web traffic.
Detects unauthorized modifications to Windows Registry Run keys that attempt to masquerade as the legitimate 'NVIDIA Container Runtime Monitor' component. Adversaries can add malicious entries to these Run keys to achieve persistence, where the specified binary executes automatically upon user login.
Detects unauthorized modifications to Windows Registry Run keys that attempt to masquerade as the legitimate 'NVIDIA Container Runtime Monitor' component. Adversaries can add malicious entries to these Run keys to achieve persistence, where the specified binary executes automatically upon user login.
Detects instances where the command shell 'cmd.exe' is launched as a child process of 'nvidia-sysruntime.exe'. This behavior is anomalous as 'nvidia-sysruntime.exe' typically does not spawn command interpreters, suggesting potential masquerading or process hollowing where an attacker is using a disguised malicious binary to execute shell commands.
This rule detects command line execution containing environment variable keys associated with the LabubaRAT malware family (e.g., ZM_ORG, ZM_KEY, ZM_SERVER). These variables are used to configure the malware's communication parameters, polling intervals, and C2 server settings during its execution.
Detects the execution of an executable named 'nvidia-sysruntime.exe', which is used by the LabubaRAT malware family to masquerade as a legitimate NVIDIA component to maintain persistence and evade detection.
Detects the execution of an executable named 'nvidia-sysruntime.exe', which is used by the LabubaRAT malware family to masquerade as a legitimate NVIDIA component to maintain persistence and evade detection.
Page 165 of 249