Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,031 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the use of reg.exe to modify registry keys associated with Windows crash-dump settings and automatic reboot policies. Such modifications are indicative of attempts to inhibit system recovery and hinder incident response analysis, often associated with wiper malware such as GigaWiper.
Detects potential User Account Control (UAC) bypass attempts using the PowerShell 'Start-Process' cmdlet with the 'runAs' verb, which requests administrative privileges for a new process. The rule also includes a specific check for command-line artifacts associated with the 'wipe32' malware campaign, which utilizes this method for privilege escalation.
Detects file creation events with the .candy extension, consistent with the GigaWiper/Crucio-derived BigBang extortion module (BigBangExtortMain, bigBangSingleFileExtortion, bigBangHybridEncryption) which AES-CBC encrypts files using randomly generated, unsaved key/IV pairs across enumerated Windows logical drives before deleting the original file with os.Remove.
Detects the creation of PNG screenshot files with a specific directory naming convention (numeric subdirectory containing numeric filename) associated with the GigaWiper destructive malware.
Detects the execution of GigaWiper malware registry modules. The rule monitors command-line activity for specific binary names associated with the GigaWiper malware family that perform registry modifications, such as key creation or deletion.
Detects the execution of command lines associated with the GigaWiper 'GRATServiceManager' module. This module is used by the GigaWiper destructive backdoor to manage services, likely for persistence or malicious service manipulation.
Detects the execution of a potential file encryption utility that uses command-line flags ('enc'/'dec', '-k'/'-i'/'--keyfile') in conjunction with a 'key.txt' file. This pattern is characteristic of custom encryption tools used by threat actors to encrypt files on a system.
Detects execution of the GigaWiper 'WipeCMain' functionality, characterized by specific command line indicators associated with a multi-pass disk wiping process. This behavior is indicative of destructive wiper malware attempting to render data on system drives irrecoverable.
Detects execution of security utility commands on macOS intended to unlock a login keychain by providing a password via command line arguments. This behavior is indicative of an attempt to programmatically access stored credentials, which may be a precursor to credential theft.
Detects the creation or modification of a specific macOS plist file ('com.apple.crashreporter.helper.plist') within the '/Library/LaunchAgents/' directory, correlated with a file event occurring in '/Library/Caches/' within a one-hour window. This behavior is indicative of an adversary attempting to establish persistence by impersonating a legitimate Apple system process and utilizing cache directories to host malicious payloads.
Page 174 of 249