Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,034 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the invocation of an unimplemented keylogger command placeholder (key '11') within the GigaWiper malware. This indicates an attempt to trigger a command that the malware is not currently configured to execute, often used for debugging or malicious functionality activation.
Detects telemetry consistent with GigaWiper's command 8 'route manager' function, which binds or unbinds targeted routing keys against a RabbitMQ 'Topic' exchange using a mode of operation (1/2/3) to enable non-broadcast, targeted command delivery over AMQP C2 channels.
Detects the execution of specific command-line arguments 'purge_cmd_queue' or 'purge_queue' associated with the GigaWiper malware. This behavior is indicative of a destructive backdoor performing command queue management to disrupt system operations or clear malicious indicators.
Detects the creation of specific RabbitMQ AMQP exchanges and bindings often associated with C2 communication patterns, such as the use of 'fanout' or 'topic' exchange types paired with common internal naming conventions or payload keywords.
Detects signs of GigaWiper malware attempting to disable system recovery, take ownership of critical Windows boot files, and subsequently delete them to ensure system failure or destruction.
Detects anomalous Redis network traffic containing structures associated with GigaWiper, specifically monitoring for 'cmd.Result' fields used by the malware to exfiltrate command output from compromised systems to a C2 server.
Detects the invocation of an unimplemented keylogger command placeholder (key '11') within the GigaWiper malware. This indicates an attempt to trigger a command that the malware is not currently configured to execute, often used for debugging or malicious functionality activation.
Detects strings associated with GigaWiper's unallocateDrive routine, which invokes DeviceIoControl with the IOCTL_DISK_CREATE_DISK control code to erase partition table metadata on non-system drives, followed by a success log message.
Detects telemetry consistent with GigaWiper's command 8 'route manager' function, which binds or unbinds targeted routing keys against a RabbitMQ 'Topic' exchange using a mode of operation (1/2/3) to enable non-broadcast, targeted command delivery over AMQP C2 channels.
This rule detects execution of specific functions or command-line arguments derived from the GigaWiper / FlockWiper malware family. These functions are associated with destructive activities such as file discovery, sorting, reading, and secure encryption or deletion of files, indicative of a wiper-style attack.
Page 173 of 249