Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,031 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects instances where a Unix shell (sh, bash, dash, ash) is spawned by or initiated from the 'ff-agent' process. This pattern often indicates malicious script execution or administrative activity associated with the agent's environment, potentially signaling post-exploitation activity or unauthorized command execution.
Detects a process that simultaneously loads 'RstrtMgr.dll' and modifies the 'WaitToKillServiceTimeout' registry value within a 2-minute window. This behavior is indicative of an adversary attempting to force system service restarts or accelerate service termination, often seen as part of persistence mechanisms or defensive impairment.
Detects pythonw.exe or python.exe process execution running under the WDAGUtilityAccount user context, which Starland RAT checks against its hardcoded sandbox-account blacklist before continuing execution. Observing this account name paired with the Python runtime used by the RAT's loader chain is a strong indicator of the malware executing (or attempting to execute) inside a sandboxed analysis environment.
Detects Python scripts initiating standard Linux system discovery commands such as id, uname, hostname, ifconfig, ip, or ps. This pattern is commonly used by adversaries for post-exploitation reconnaissance to profile the host environment.
Detects Python processes (python.exe or pythonw.exe) executed with a custom '--elevated' argument, which is indicative of Starland RAT attempting to perform UAC bypass or elevation.
Detects Python processes (python.exe or pythonw.exe) executed with a custom '--elevated' argument, which is indicative of Starland RAT attempting to perform UAC bypass or elevation.
Detects the Starland RAT's self-deletion routine, which invokes os.remove(script_path) followed by sys.exit() when the C2 responds with an HTTP 403 kill-switch. The deleted file path matches the executing Python interpreter's own script/image path, indicating classic self-delete behavior.
Detects the execution of PowerShell scripts associated with the WLDR Agent, specifically looking for indicators of RunspacePool initialization, module runspace starts, and message queue communication patterns.
Detects the execution of rundll32.exe with specific suspicious DLLs (drx_curator.dll, etwhost.dll) and specific function names or paths. This pattern is indicative of potential malicious activity where legitimate binaries are leveraged to execute code, often associated with modular loaders or malicious payloads.
Detects instances where the WLDR Agent attempts to execute code via 'Start-ModuleJob' and subsequently hits an error condition, forcing a fallback to native PowerShell 'Start-Job' cmdlets. This pattern of falling back from a specialized execution environment to standard, potentially less-monitored, background jobs can indicate an attempt to bypass existing runspace restrictions or execution policies.
Page 182 of 249