Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,036 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the creation of SQLite database files associated with the LabubaRAT malware implant. The rule monitors for the nvidia-sysruntime.exe process creating specific database files (nvctr_sys.db and its associated journal/shared memory files) which are used for staging collected data.
Detects the creation of SQLite database files associated with the LabubaRAT malware implant. The rule monitors for the nvidia-sysruntime.exe process creating specific database files (nvctr_sys.db and its associated journal/shared memory files) which are used for staging collected data.
Detects the LabubaRAT implant (masquerading as nvidia-sysruntime.exe) performing file system checks against Chrome, Firefox, Microsoft Edge, and Brave installation paths as part of its enumerate_browsers() host profiling routine.
Detects the execution of Microsoft Edge WebView2 (msedgewebview2.exe) as a child process of the NVIDIA system runtime (nvidia-sysruntime.exe). This pattern is associated with LabubaRAT, where the legitimate NVIDIA process is abused to launch WebView2 for command-and-control (C2) communication and data exfiltration.
Detects file write operations performed by 'nvidia-sysruntime.exe', a known masquerading binary used by LabubaRAT. This activity signifies the RAT's operator-directed tasking where attacker-controlled data is written to the file system.
Detects file write operations performed by 'nvidia-sysruntime.exe', a known masquerading binary used by LabubaRAT. This activity signifies the RAT's operator-directed tasking where attacker-controlled data is written to the file system.
Detects execution or file activity associated with 'nvidia-sysruntime.exe', a known masquerading file name used by LabubaRAT, which often performs unauthorized archiving or staging of data.
Detects the use of GDI functions (GetDC, CreateCompatibleBitmap, BitBlt, GetDIBits) combined with suspicious base64 encoding activity by a process masquerading as an NVIDIA binary (nvidia-sysruntime.exe). This behavior is indicative of screen capture and exfiltration attempts typical of the LabubaRAT implant.
This rule detects potentially unauthorized database manipulation of the 'xadmin' platform, including suspicious administrative role modifications and deletions. It also monitors for suspicious Python script execution involving the 'bcrypt' library, which can be used to generate or verify password hashes in potentially malicious scripts.
Detects macOS Mach-O binaries containing AES-GCM cipher references combined with /tmp staging paths, consistent with CrashStealer encrypting stolen data locally with AES-GCM before staging it in /tmp for exfiltration
Page 166 of 249