Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,031 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects potential anonymization attempts by identifying systems that connect to the Tor network check service followed closely by processes accessing local machine identifiers, such as machine-id or board serial numbers. This behavior may indicate an actor attempting to verify anonymity or fingerprint a host while routing traffic through Tor.
Detects the execution of unusual or unauthorized processes spawned during an 'npm install' operation, specifically those occurring within a 'node_modules' folder context. This behavior is indicative of potential supply chain attacks where a malicious package executes unauthorized code during installation.
Detects the creation of a Windows Shortcut (.lnk) file in the Startup folder using WScript.Shell, often used by the Starland RAT or similar malware to establish persistence. The rule monitors command lines for the combination of WScript.Shell invocation, the CreateShortcut method, and targeting of pythonw.exe or LICENSE.txt files.
Detects file access events targeting sensitive browser files, specifically 'passwords.json' and 'cookies.json', located within the standard Chrome/browser application data directories. These files often contain stored credentials and session cookies, and unauthorized access is a common precursor to credential theft.
Detects anomalous activity where a single process or actor attempts to stop or reconfigure a large number of system services, specifically targeting backup, database, security, and administrative services. This behavior is highly indicative of ransomware or destructive malware activity attempting to disable defenses and data recovery capabilities.
Detects the execution of the Mimikatz credential dumping tool, either as the initiating process or the action process, indicating potential credential theft attempts.
Detects potential screenshot activity by monitoring the creation and subsequent deletion of .png image files by the pythonw.exe process, a pattern observed in Starland RAT post-compromise activity.
Detects process injection attempts leveraging Asynchronous Procedure Calls (APC) by monitoring process access events for a characteristic API call sequence involving VirtualAllocEx, WriteProcessMemory, QueueUserAPC, and CreateRemoteThread, commonly associated with the Starland RAT.
Detects the Starland RAT's self-deletion routine, which invokes os.remove(script_path) followed by sys.exit() when the C2 responds with an HTTP 403 kill-switch. The deleted file path matches the executing Python interpreter's own script/image path, indicating classic self-delete behavior.
Detects instances where a process named 'symantec.exe' is executed from a path other than the standard Symantec installation directories. This behavior is indicative of an attempt to disguise a malicious executable as a legitimate Symantec software component.
Page 175 of 249