Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,034 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the execution of command lines associated with the GigaWiper 'GRATServiceManager' module. This module is used by the GigaWiper destructive backdoor to manage services, likely for persistence or malicious service manipulation.
Detects the execution of a potential file encryption utility that uses command-line flags ('enc'/'dec', '-k'/'-i'/'--keyfile') in conjunction with a 'key.txt' file. This pattern is characteristic of custom encryption tools used by threat actors to encrypt files on a system.
Detects the execution of a potential file encryption utility that uses command-line flags ('enc'/'dec', '-k'/'-i'/'--keyfile') in conjunction with a 'key.txt' file. This pattern is characteristic of custom encryption tools used by threat actors to encrypt files on a system.
Detects the use of bcdedit.exe and reagentc.exe to disable Windows system recovery and boot failure remediation, a common technique used by malware to inhibit system restoration after a destructive or ransomware attack.
Detects the use of bcdedit.exe and reagentc.exe to disable Windows system recovery and boot failure remediation, a common technique used by malware to inhibit system restoration after a destructive or ransomware attack.
Detects the creation of scheduled tasks using PowerShell commands that incorporate execution policy bypass and hidden window styling. This pattern is commonly observed in malware loaders and persistence mechanisms to minimize visual indicators during execution.
Detects potential disk wiping activity by identifying the enumeration of physical disk drives via WMI queries combined with command-line arguments indicative of destructive wiping tools, such as functions related to unallocating drives or writing random data.
Detects the execution of XMRig cryptocurrency miner or network connections to known mining pool endpoints associated with XMRig, masquerading as or originating from the legitimate Windows process 'fontdrvhost.exe'. This behavior indicates potential resource hijacking.
Detects the creation or registration of scheduled tasks involving the suspicious artifact 'SolidPDFPcl2Bmp'. This monitoring covers process executions using schtasks.exe or reg.exe, registry modifications to the Windows Task Scheduler cache, and file drops within the Windows System32 Tasks directory, which are common indicators of persistence establishment via scheduled tasks.
Detects the execution of the MinIO Client (mc.exe) on Windows with command-line arguments indicating the interaction with external or arbitrary bucket and endpoint locations. This behavior is indicative of an attacker staging or exfiltrating data to an external S3-compatible cloud storage provider.
Page 171 of 249