Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,034 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the execution of specific command-line arguments 'purge_cmd_queue' or 'purge_queue' associated with the GigaWiper malware. This behavior is indicative of a destructive backdoor performing command queue management to disrupt system operations or clear malicious indicators.
Detects the execution of specific command-line arguments 'purge_cmd_queue' or 'purge_queue' associated with the GigaWiper malware. This behavior is indicative of a destructive backdoor performing command queue management to disrupt system operations or clear malicious indicators.
Detects the execution of PowerShell commands containing a specific obfuscated output marker pattern ('|?????|$pwd') associated with the GigaWiper backdoor.
Detects the execution of PowerShell commands containing a specific obfuscated output marker pattern ('|?????|$pwd') associated with the GigaWiper backdoor.
Detects the creation of specific RabbitMQ AMQP exchanges and bindings often associated with C2 communication patterns, such as the use of 'fanout' or 'topic' exchange types paired with common internal naming conventions or payload keywords.
Detects anomalous Redis network traffic containing structures associated with GigaWiper, specifically monitoring for 'cmd.Result' fields used by the malware to exfiltrate command output from compromised systems to a C2 server.
This rule detects the presence of a specific file named 'g11.sys' being loaded or accessed on a system, followed by the execution of 'sc.exe' to register or create a system service involving the same driver file. This pattern is commonly associated with the installation of kernel-mode drivers, which could be part of a rootkit deployment or a 'Bring Your Own Vulnerable Driver' (BYOVD) attack.
Detects the use of the 'EnumSystemLocalesA' API call where the provided callback address points to a non-image backed memory region with 'EXECUTE' permissions. This pattern is indicative of process injection techniques, where an adversary uses an API callback mechanism to execute malicious code within the memory space of a legitimate process.
Detects DNS query attempts to a known malicious IP address (179.43.166.242) associated with the CrashStealer malware campaign, indicating potential command-and-control communication.
This rule detects processes command lines containing keywords associated with anti-debugging techniques, such as 'PT_DENY_ATTACH' (a common macOS ptrace flag used to prevent debugger attachment) or generic 'ptrace' and 'sysctl' system calls often leveraged by malware for process introspection or debugger evasion.
Page 172 of 249