Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,031 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the creation of a crontab entry configured to execute a Python one-liner that performs a network connection to a specific remote IP address on port 4444. This behavior is indicative of a persistence mechanism and a C2 (Command and Control) beaconing attempt.
Detects reconnaissance activities targeting Azure Container Registry, specifically the listing of available repositories using the Azure CLI and pulling container images, which may indicate an adversary attempting to discover or exfiltrate software components.
Detects potential discovery of sensitive information (secrets) within container images by monitoring for the usage of 'dive' targeting private Azure Container Registry images or the use of 'docker inspect' to extract 'Config.Env' combined with 'grep' for the term 'secret'. This activity is often associated with reconnaissance for credential harvesting in containerized environments.
Detects Azure CLI operations creating or modifying an Azure Container Registry (ACR) Task with an attached managed identity, where the task definition references Key Vault secrets. This pattern is used to abuse ACR Task automation and its managed identity to exfiltrate Key Vault secrets.
Detects the manual execution of an Azure Container Registry (ACR) task using the 'az acr task run' command. This could indicate an adversary attempting to leverage ACR build capabilities to execute malicious build steps, pull images, or perform unauthorized automation tasks within the container registry environment.
Detects the use of 'docker login' commands targeting an Azure Container Registry (.azurecr.io) that include a password passed as a plaintext argument via the '-p' or '--password' flags. This practice exposes credentials in process command-line arguments, which may be visible to other users on the system or logged by security tools.
Detects HTTP traffic originating from external sources that contains response body patterns associated with a DEBULL-themed phishing lure. This rule specifically identifies content indicators related to device-code broker phishing, where a user is tricked into navigating to a malicious URL (debull.app) to authorize access or provide credentials.
Detects static HTML/JS/CSS artifacts matching the DEBULL device-code phishing template via admin.css SHA256, Composer content-hash, and Turkish-language code markers
Detects network traffic characterized by a specific rotating domain generation algorithm (DGA) pattern using .xyz TLD with a 10-digit timestamp, in combination with a specific URI structure containing 'script?id=' and the suspicious 'tag=WinUpdateHelper' parameter. This behavior is indicative of C2 communication.
This rule detects incoming emails containing specific subject lines related to 'Request for Payment' and 'Shared Folder' that include links to the '/Team_Meets/' path. It flags instances where the sender's domain differs from the domain hosting the embedded link, which is a common indicator of phishing or credential harvesting attempts using domain masquerading.
Page 180 of 249