Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,031 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects execution or file activity associated with 'nvidia-sysruntime.exe', a known masquerading file name used by LabubaRAT, which often performs unauthorized archiving or staging of data.
Detects the use of GDI functions (GetDC, CreateCompatibleBitmap, BitBlt, GetDIBits) combined with suspicious base64 encoding activity by a process masquerading as an NVIDIA binary (nvidia-sysruntime.exe). This behavior is indicative of screen capture and exfiltration attempts typical of the LabubaRAT implant.
Detects network logs identifying exploitation attempts or vulnerability scans targeting known Ruckus Wireless vulnerabilities (CVE-2020-22653, CVE-2020-22658, CVE-2023-25717). The rule parses CommonSecurityLog entries where the device, message, or activity fields contain references to these specific vulnerabilities.
Detects a process attempting to delete its own executable file on disk. This is a common anti-forensic technique used by malware to hinder investigation and remove traces of its presence after execution.
Detects self-narrating LLM-generated ransomware payload artifacts referencing ransom infrastructure and encryption routines (JadePuffer)
This rule detects potential brute force or password guessing attempts by monitoring Windows security logs for instances where a failed logon (Event ID 4625) is followed by a successful logon (Event ID 4624) for the same user on the same host within a 60-second window.
Detects HTTP traffic identified as MarkiRAT command and control beaconing, characterized by a specific multipart POST request structure directed at a known malicious URI and domain.
This rule detects the use of PowerShell to modify Windows Defender preferences, specifically by adding exclusions for paths or processes. Attackers commonly use this technique to exclude malicious files, directories, or process names from antivirus scanning, thereby facilitating the execution and persistence of malware.
Detects attempts to disable or modify Microsoft Defender Antivirus security settings through PowerShell commands (Set-MpPreference/Add-MpPreference) or by modifying Windows Registry keys related to Defender exclusions. Attackers often use these techniques to bypass security controls and prevent detection of malicious files or processes.
Detects the loading of 'abe_decrypt.dll' into Google Chrome or Microsoft Edge browser processes. This behavior is highly irregular and often associated with browser-based malware, credential theft, or injection attempts to intercept browser data.
Page 189 of 249