Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,036 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects sign-in attempts where the OAuth Client ID (AppId) does not have a corresponding display name (AppDisplayName) in the logs, and the same Client ID is observed across multiple different Azure tenants. This pattern often indicates an adversary using a malicious or spoofed OAuth application to perform multi-tenant abuse, consent phishing, or unauthorized access across different organizational boundaries.
Detects instances of Node.js processes executing command-line instructions related to publishing packages (npm, twine, or cargo). This behavior is characteristic of Miasma malware's 'trySpread' routine, which attempts to propagate the malware by leveraging compromised package repository tokens.
Detects anomalous authentication patterns originating from a single IP address where multiple users are targeted. The rule specifically monitors for a combination of error codes (50034 - User not found, 50126 - Invalid credentials, 700016 - Multi-factor authentication required) to identify potential password spraying or brute force activity targeting Microsoft Entra ID (formerly Azure AD).
Detects potential credential harvesting or account enumeration activity by identifying successful enumeration of user accounts (via specific sign-in result codes) followed by a spike in account lockouts for the same users within a 60-minute window. This behavior is indicative of an attacker verifying valid accounts before launching a targeted brute force or credential stuffing campaign.
This rule monitors for a high volume of WebDAV PROPFIND HTTP requests directed toward a specific domain associated with malware staging activities. The detection threshold is set to 50 requests within a 300-second window, which is indicative of automated attempts to enumerate or download malicious content using the WebDAV protocol.
Detects the creation of a registry run key with a specific randomized value name, often used by malware to maintain persistence on a Windows system. The rule monitors the Run key locations for indicators of automated execution at login.
Detects the creation of specific file artifacts on disk associated with Stealth Falcon's WebDAV-based delivery and staging infrastructure. The rule looks for filenames characteristic of their simulated 'clickfix' and application update social engineering themes.
Detects the presence or loading of files named 'profiler16.dll' or 'loader-pool.db', which are associated with in-memory payload staging and execution techniques typically used by IDAT (a modular, multi-stage loader).
Detects process creation events where a file name containing a Right-to-Left Override (RTLO) character (U+202E) also ends with a .scr extension and includes a bait keyword ('ReportFinal'). This combination suggests an attempt to disguise a malicious screensaver file as a benign PDF document to deceive users into executing it.
Detects instances of process hollowing involving specific security product images (Qihoo 360) or identified binaries (MegArray.exe, Crisp.exe) as indicated by process tampering logs. This behavior is associated with advanced threat activity potentially attempting to masquerade malicious execution under trusted or known-path binary contexts.
Page 168 of 249