Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,031 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects PowerShell execution initiating WMI queries to gather information about antivirus products, network adapter configurations, or User Account Control (UAC) policy settings. This behavior is indicative of system and defensive environment reconnaissance.
Detects command-line execution patterns associated with the Starland RAT, specifically focusing on systematic Active Directory and domain environment reconnaissance. The rule triggers on the use of built-in Windows utilities such as WMI queries for system details, command-line enumeration of users and domain controllers (e.g., net user /domain, nltest /dclist), and detailed identity information gathering (e.g., whoami /all).
Detects command-line execution patterns associated with the Starland RAT, specifically focusing on systematic Active Directory and domain environment reconnaissance. The rule triggers on the use of built-in Windows utilities such as WMI queries for system details, command-line enumeration of users and domain controllers (e.g., net user /domain, nltest /dclist), and detailed identity information gathering (e.g., whoami /all).
Detects unauthorized processes attempting to access sensitive credential database files (Login Data, key4.db, logins.json) used by Chromium-based browsers or Mozilla Firefox. This behavior is indicative of credential theft attempts, where malicious actors seek to extract saved passwords and cookies from the browser's local storage.
Detects unauthorized access attempts to session files and account credentials stored locally by Discord, Telegram, and Steam applications, a behavior consistent with the CastleStealer malware.
Detects a sequence of authentication events from a specific IP address associated with the Microsoft Authentication Broker app, where an initial MFA challenge (ResultType 50199 - MFA challenge) is followed by a successful authentication (ResultType 0). This pattern is indicative of MFA fatigue attacks where an adversary repeatedly prompts a user until they inadvertently approve the request.
Detects Microsoft Entra ID sign-in events where the AppId (OAuth client_id) is a
syntactically valid UUIDv4 but no corresponding AppDisplayName is populated,
indicating the client ID does not correspond to any registered enterprise
application in the tenant. This pattern is consistent with randomly generated,
valid-format spoofed client IDs used in ROPC-based username/password
enumeration.
syntactically valid UUIDv4 but no corresponding AppDisplayName is populated,
indicating the client ID does not correspond to any registered enterprise
application in the tenant. This pattern is consistent with randomly generated,
valid-format spoofed client IDs used in ROPC-based username/password
enumeration.
Detects Microsoft Entra authentication events using the Resource Owner Password Credentials (ROPC) grant type where the User-Agent string explicitly identifies as a Microsoft Outlook desktop client. Adversaries often spoof these User-Agent strings in OAuth client ID campaigns to bypass conditional access policies or appear as legitimate traffic during automated login attempts.
Detects a high-volume burst of ROPC (Resource Owner Password Credentials) sign-in attempts using a spoofed/unregistered OAuth client ID, identified by a populated Application ID field paired with a blank Application Name field, targeting a single account within a short window. This enumeration pattern has been observed to correlate with mass account lockouts across an organization.
This rule detects potential password spraying or brute-force activity by monitoring Azure Sign-in logs for a high volume of failed authentication attempts (error code 50126) originating from a single IP address across multiple distinct user accounts.
Page 176 of 249