Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,031 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the execution of nvidia-sysruntime.exe, a process name used by LabubaRAT for host reconnaissance. The detection relies on identifying this specific filename, which in the context of the malware is often unsigned or associated with malicious activity as opposed to legitimate NVIDIA Container Toolkit components.
Detects the execution of nvidia-sysruntime.exe, a process name used by LabubaRAT for host reconnaissance. The detection relies on identifying this specific filename, which in the context of the malware is often unsigned or associated with malicious activity as opposed to legitimate NVIDIA Container Toolkit components.
Detects file creation or deletion activity performed by nvidia-sysruntime.exe, the process name used by LabubaRAT, consistent with its RAT tasking module supporting delete and mkdir actions on the local filesystem.
Detects file creation or deletion activity performed by nvidia-sysruntime.exe, the process name used by LabubaRAT, consistent with its RAT tasking module supporting delete and mkdir actions on the local filesystem.
Detects the use of the Windows 'attrib.exe' utility to hide a file named 'svehost.exe' within the 'AppData\Windows' directory. This behavior is indicative of an adversary attempting to conceal malicious artifacts or persistence mechanisms from the user and basic system exploration tools.
This rule monitors for the creation or modification of specific files (e.g., AGENTS.md, MEMORY.md, IDENTITY.md) that often mimic agent-based collection or configuration files. It specifically identifies when these files are created by processes associated with scheduling mechanisms like 'cron' or 'scheduler', or triggered by a 'heartbeat' event, which is potentially indicative of adversary data collection or staging activity.
This rule detects potential automated data exfiltration or staging behavior by identifying the concurrent execution of email-related processes and vector database memory modification commands (insert/upsert) within a 5-minute window on the same host. This combination may indicate an attacker extracting data from email systems and injecting it into a local vector memory store, likely for subsequent LLM-based analysis or exfiltration.
This rule identifies instances where files are written to the system by processes that lack associated administrative notification or acknowledgment command-line patterns. By joining file-write events with process command-line data, it isolates file creation or write operations performed by potentially unmonitored or non-standard administrative processes, which could indicate suspicious file activity.
Detects a sequence of file write operations followed by file read operations on specific files named 'AGENTS.md', 'MEMORY.md', 'IDENTITY.md', 'USER.md', or 'SOUL.md' with a significant time gap between the operations. This pattern is indicative of data staging, where an adversary writes sensitive information to a file and subsequently reads it for exfiltration.
Detects execution or file activity associated with 'nvidia-sysruntime.exe', a known masquerading file name used by LabubaRAT, which often performs unauthorized archiving or staging of data.
Page 178 of 249