Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,031 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the execution of Node.js processes launched by VS Code (via task runner) that reference known Miasma malware persistence paths (e.g., sync.js in hidden NodeJS directories across Windows, Linux, or macOS).
This rule detects processes attempting to access known cryptocurrency wallet data files. These files, such as 'wallet.dat' or 'wallet.json', are high-value targets for attackers seeking to exfiltrate cryptographic assets. The rule excludes common, legitimate cryptocurrency wallet applications that are expected to access these specific files.
This rule detects node.js processes that either attempt to read sensitive cloud credential or configuration files (AWS, Google Cloud, Azure) or establish network connections to a specific remote IP address (85.137.53.71) on ports 8080 or 8081. This behavior is indicative of credential theft or potential command and control (C2) activity from a compromised node environment.
This rule detects processes being executed that contain 'nacos' and 'token.secret.key' within their command-line arguments. This pattern is indicative of potential attempts to leverage or identify the default JWT secret key for an Apache Nacos deployment, which could allow an attacker to forge authentication tokens and gain unauthorized access.
This rule monitors for the execution of Azure CLI commands used to enumerate role assignments and Azure Container Registry (ACR) details. Adversaries often perform this reconnaissance to identify high-privilege accounts, discover container registries, or map out permissions to facilitate lateral movement or persistence within an Azure environment.
Detects attempts to retrieve Azure Container Registry (ACR) credentials, either by executing specific Azure CLI commands on a host or by initiating the Microsoft.ContainerRegistry/registries/listCredentials/action via Azure Activity Logs. Such activities may indicate an adversary attempting to gain unauthorized access to container registries.
Detects the execution of an Azure Container Registry (ACR) task utilizing a specifically named 'secret-task.yaml' file, which is often associated with adversary attempts to leverage cloud automation for malicious container deployment or secret exfiltration.
Detects modifications to enable the admin account for an Azure Container Registry (ACR), or queries to check the status of this setting. Enabling the admin account provides a static username/password combination that can be used for authentication, which may represent an security risk or account manipulation if not authorized.
Detects execution of common shell interpreters initiated by or containing references to ff-agent.
Detects Node.js processes generating text or log files containing diagnostic markers related to network activity monitoring, such as 'Network Connection Dump Snapshot' or 'Monitoring active egress sockets'. This behavior is characteristic of custom tool execution used for network discovery and data collection on a host.
Page 186 of 249