Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,031 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects process, named pipe, or mutex events that contain the specific string 'BEAST HERE?', which is often associated with the presence of malicious tools or backdoors using this hardcoded string for identification or synchronization.
Detects the use of system utilities (net.exe, net1.exe, taskkill.exe, sc.exe) to stop five or more services identified as security, backup, or database software. This behavior is indicative of an adversary attempting to disable security monitoring and backup recovery tools, a common precursor to ransomware encryption.
Detects an internal host performing network scanning against multiple internal IP addresses or multiple ports, which is indicative of lateral movement, reconnaissance, or automated worm-like activity within the local network.
Detects potential exploitation attempts targeting Ruckus devices using known CVEs.
Detects the execution of an executable named 'nvidia-sysruntime.exe', which is used by the LabubaRAT malware family to masquerade as a legitimate NVIDIA component to maintain persistence and evade detection.
Detects execution of nvidia-sysruntime.exe, which is known to be a malicious file masquerading as a legitimate NVIDIA component, often associated with the LabubaRAT malware.
Detects the LabubaRAT implant (masquerading as nvidia-sysruntime.exe) performing file system checks against Chrome, Firefox, Microsoft Edge, and Brave installation paths as part of its enumerate_browsers() host profiling routine.
Detects the execution of Microsoft Edge WebView2 (msedgewebview2.exe) as a child process of the NVIDIA system runtime (nvidia-sysruntime.exe). This pattern is associated with LabubaRAT, where the legitimate NVIDIA process is abused to launch WebView2 for command-and-control (C2) communication and data exfiltration.
Detects file creation or deletion activity performed by nvidia-sysruntime.exe, the process name used by LabubaRAT, consistent with its RAT tasking module supporting delete and mkdir actions on the local filesystem.
Detects file write operations performed by 'nvidia-sysruntime.exe', a known masquerading binary used by LabubaRAT. This activity signifies the RAT's operator-directed tasking where attacker-controlled data is written to the file system.
Page 188 of 249