Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,036 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the presence of multiple anti-debugging and anti-analysis JavaScript techniques within HTTP response content, commonly used in phishing landing pages to prevent security analysts from inspecting the site's behavior. The rule specifically looks for combinations of event listeners for the context menu, disabling F12 developer tools, debugger timing-loop checks, and automatic 'about:blank' redirects upon pause detection.
Detects execution of the macOS 'dscl' utility using the '-authonly' flag. This command is used to authenticate a user against a directory service without creating a session, which can be indicative of brute-force attempts or credential validation by unauthorized processes.
Detects processes attempting to read sensitive browser storage files, specifically 'Login Data' (passwords) and 'Cookies', located within common browser paths for Chrome, Firefox, and Safari on macOS or similar environments using Application Support/Library folders.
Detects the use of the macOS 'codesign' utility to sign binaries using a self-signed or empty identity certificate. This technique is often used by adversaries to bypass Gatekeeper security controls or to make unsigned malicious binaries appear legitimate.
Detects instances where the 'Werkbit' process initiates either 'curl' or 'bash' to download files from GitHub-related domains. This behavior is indicative of a living-off-the-land technique used to fetch secondary payloads or scripts during a post-exploitation phase.
This rule detects potential ransomware activity by monitoring for high-frequency file renaming operations combined with the presence of specific file extensions often associated with encryption and the concurrent creation of ransom note files (e.g., 'README.TXT').
Detects network connections to Zoho WorkDrive (workdrive.zoho.com) initiated by processes other than standard web browsers. This activity may indicate the use of unauthorized or automated tools to access cloud storage, potentially for data exfiltration or staging.
Detects potential Resource Owner Password Credential (ROPC) password guessing attempts in Entra ID by monitoring for multiple AADSTS50126 (Invalid Username or Password) errors. Attackers may abuse ROPC to bypass multi-factor authentication requirements or perform brute-force attacks against cloud identities.
Detects the use of spoofed Exchange Online Application IDs in Azure sign-in logs. Attackers use these specific spoofed AppID patterns to bypass controls during Resource Owner Password Credential (ROPC) authentication, often for user enumeration purposes.
This rule detects authentication attempts in Azure AD Sign-in Logs where the User Agent identifies the request as originating from the Python Requests library (version 2.32.3). This pattern is often indicative of Resource Owner Password Credentials (ROPC) flows, which are frequently abused by threat actors to perform credential stuffing or automated authentication bypassing multi-factor authentication (MFA) requirements in cloud environments.
Page 167 of 249