Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,031 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects instances where PowerShell is executed with common bypass flags by a process masquerading as or spawned by 'svchost.exe' located in non-standard system directories, specifically targeting executions originating from user-writable temporary locations.
Detects presence of known-malicious Jscrambler npm supply chain dropper artifact filenames dist/setup.js and dist/intro.js referenced or embedded within scanned content (package contents, tarballs, manifests)
This rule detects the execution of 'node.exe' or 'node' processes that involve specific JavaScript files ('dist/setup.js' or 'dist/intro.js') within the command line arguments or file paths. Such patterns are indicative of potential malicious activity, often associated with the deployment of unauthorized scripts or secondary payloads in a node.js environment.
Detects the execution of a file named 'intro.js' by the Node.js runtime located within a 'node_modules' directory. This pattern is often associated with the execution of suspicious scripts, persistent backdoors, or malicious packages that attempt to masquerade as standard dependencies.
Detects network traffic (DNS, TLS SNI, and HTTP Host header) to the domain 'couldinstallup.com', which is associated with Command and Control (C2) activity by the threat group Mustang Panda.
Detects network activity related to the exploitation of the Microsoft Support Diagnostic Tool (MSDT) vulnerability known as Follina (CVE-2022-30190), characterized by URIs containing both the CVE identifier and the MSDT string.
Detects incoming HTTP requests directed at the Nacos server application path that contain specific identifiers indicative of an exploitation attempt for CVE-2021-29441. This vulnerability allows an attacker to bypass authentication mechanisms.
Detects the execution of PowerShell (powershell.exe) spawned by the Windows Command Shell (cmd.exe) where the command originated from user-writable directories such as Downloads, Temp, or AppData\Local\Temp. This pattern is commonly associated with the execution of downloaded payloads or malicious scripts.
This rule detects attempts to jailbreak Large Language Models (LLMs) by monitoring event logs and process command lines for indicators of 'Prompt Shields' activity. It specifically identifies when a jailbreak attempt is either detected or blocked by security controls.
Detects potential LLM prompt injection or jailbreak attempts within command line arguments or event log data, such as instructions to override system prompts or masquerade as a specific persona.
Page 181 of 249