Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,031 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects processes other than the authorized system processes ('security' and 'securityd') interacting with the login.keychain-db file. Adversaries often target this file to extract stored credentials from the macOS keychain.
Detects new file creation or modification events within the /Library/Caches/ directory of user profiles on macOS. Adversaries may utilize these directories for persistence, staging, or hiding malicious payloads.
This rule detects processes attempting to open or read files commonly associated with cryptocurrency wallets (Exodus, Electrum, MetaMask) on the endpoint. Unauthorized access to these files is a common indicator of credential theft or attempts to compromise wallet data.
Detects PowerShell command line activity involving the use of Net.WebClient for network downloads in conjunction with IO.Compression.ZipArchive for file extraction, specifically targeting paths associated with the LogiOptionsPlus software. This pattern suggests potential staging of malicious payloads, such as an embedded Python loader or binary disguised within a legitimate directory.
Detects the creation of a remote thread that initiates execution from memory that is not backed by a known file module on disk. This is a common indicator of process injection techniques, such as reflective DLL injection or shellcode execution, where the payload exists only in memory.
Detects the execution of processes where the image name or path contains the string 'werkbit'. This is often associated with the execution of potentially malicious or unauthorized tools.
Detects the execution of the xattr command with the '-cr' flags on macOS. This combination is commonly used to recursively remove the com.apple.quarantine extended attribute from files and directories, which effectively bypasses macOS Gatekeeper security checks for downloaded applications or files.
Detects repeated execution of 'defaults read' or 'du -sh' commands within a one-hour window. These commands are commonly used for system information and file directory discovery, which may indicate reconnaissance activity by an attacker.
Detects the loading of 'bindfltapi.dll' or 'bindlink.dll' by processes other than known legitimate system or container management services. These DLLs are associated with Bind-Link Management, and their loading by unexpected processes could indicate potential DLL hijacking or unauthorized abuse of these modules.
Detects Docker CLI execution attempting to bind mount sensitive host system directories (e.g., Windows, ProgramData) into a container. This technique is often used as a container escape vector to gain unauthorized access to host files and escalate privileges to SYSTEM.
Page 179 of 249