Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,031 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects DNS queries for domains associated with Kratos Phishing-as-a-Service (PhaaS) hosting infrastructure. This activity is indicative of a user or system attempting to resolve domains used for phishing campaigns or command and control communication.
Detects instances where a Java process (java.exe/java) spawns common network utilities such as FTP, SFTP, or Netcat. This activity is often associated with exploitation of Java-based applications, potentially indicating post-exploitation behavior such as data exfiltration or manual command and control communication.
Detects instances where a process named 'svchost.exe' is executed from common temporary file paths, which is characteristic of malware attempting to masquerade as the legitimate Windows Service Host process.
This rule detects the creation of sensitive files (e.g., AGENTS.md, MEMORY.md, IDENTITY.md) on a host where there is either no corresponding chat interaction or the corresponding chat interaction lacks specific warning or security-related flags. This is intended to surface potentially unauthorized local data staging or access of system-level metadata files.
This rule monitors network DNS queries for patterns commonly associated with webhook notification services or potential C2 infrastructure. It looks for specifically formatted domains (e.g., 'api.[random]-notifier.[tld]', 'build-notifier' substrings, or custom API subdomains on common cloud-native TLDs) which may indicate the use of webhook services for data exfiltration or adversary command and control.
This rule detects execution of commands or network traffic containing strings indicative of EDR bypass attempts, obfuscation frameworks, or C2 hosting/infrastructure. This usually signals active adversary efforts to evade defensive controls or setup command-and-control communication.
Detects read, creation, or modification events involving common cryptocurrency wallet files (e.g., wallet.dat) or directories associated with wallet applications (Exodus, Electrum, Ledger Live) located within user application support directories. This behavior is indicative of credential access attempts where an adversary is trying to steal private keys or wallet data.
Detects process execution where the process path or the initiating process path resides within the '/private/tmp/.CrashReporter' directory. This directory is often used by adversaries to hide malicious binaries or scripts in a location that might appear legitimate but is generally inappropriate for persistence or staging.
Detects the use of the security command-line tool with the 'unlock-keychain' argument and the '-p' flag, which indicates an attempt to programmatically unlock a keychain, potentially using a supplied password.
This rule detects unauthorized read, creation, modification, or renaming activity involving sensitive browser files (Login Data, Cookies, Web Data) on macOS. Adversaries often target these files to extract saved credentials, cookies for session hijacking, or browsing history.
Page 184 of 249