Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the modification of the Image File Execution Options (IFEO) registry key for the Microsoft Defender service executable (MsMpEng.exe) by setting a 'Debugger' value. This technique is often used to impair security defenses by redirecting or preventing the execution of the Antivirus engine.
Detects the creation of a scheduled task using schtasks.exe that involves the string 'CrysomeLoader' in the command line, which is indicative of persistence or execution mechanisms associated with the CrysomeLoader malware.
Detects HTTP POST requests directed at a '/save.php' URI, a common signature associated with the Kratos phishing kit used for capturing and exfiltrating user credentials.
This rule detects the execution of the Mimikatz credential dumping tool by monitoring for specific process names or command-line arguments, including the use of 'sekurlsa' modules to harvest credentials from memory. Mimikatz is widely used by adversaries to perform credential theft, including dumping passwords, hashes, and Kerberos tickets from memory.
Detects the use of the built-in Windows utility esentutl.exe to copy sensitive registry hives (SAM, SECURITY, or SYSTEM). This is a known technique used by adversaries to perform offline credential dumping by accessing the registry hive files.
This rule identifies network traffic containing specific strings associated with known malicious command-and-control (C2) behavior, such as hardcoded PHP script names often used by web shells, connection attempts to Telegram API servers for exfiltration, and other identifiable strings often associated with threat actor interaction.
Detects SHARDLOADER/ZOHOMURK/MINIRECON related loader DLL via embedded mutex name, XOR key, staging file paths, and exported function used in Mustang Panda campaigns
This rule detects potential automated bot, crawler, or scraper activity by identifying network requests that contain suspicious strings in the URI (e.g., 'captcha') or User-Agent header (e.g., 'bot', 'crawler', 'spider'). The rule aggregates events by DNS query and remote IP, flagging entities that exhibit high-frequency requests across multiple unique User-Agents, which is a common behavior of sophisticated web scrapers or automated scanning tools attempting to bypass simple detection.
Detects the execution of processes originating from the /private/tmp/.CrashReporter directory on macOS systems. This path is often used by adversaries to store or execute malicious binaries in a hidden, temporary location to evade detection.
Detects instances where a process creates, renames, or copies a file into the /Library/Caches/ directory where the resulting file's SHA256 hash matches the SHA256 hash of the initiating process. This behavior suggests a binary or script is creating a copy of itself within a writable system cache directory, a common technique for establishing persistence or running code from a less conspicuous location.
Page 190 of 249