Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,031 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the execution of a process named 'Werkbit' or containing 'Werkbit' in its command line that is associated with 'com.apple.crashreporter' but is located outside the standard '/Applications/' directory on macOS. This behavior may indicate an attempt to masquerade or execute unauthorized code disguised as a crash reporting process.
Detects the use of the macOS 'codesign' utility with command-line flags that suggest an attempt to sign a binary with an empty or improperly formatted identity string. This pattern is often used to quickly sign binaries with an ad-hoc signature to bypass security restrictions or for malicious purposes.
This rule monitors security logs for evidence of exploitation attempts targeting CVE-2025-2492 or malicious activity related to the 'AiCloud' platform. It scans incoming log messages for these specific indicators to identify potentially compromised network requests.
Detects the creation or execution of the SysAid.exe binary, which is a legitimate Remote Monitoring and Management (RMM) tool. Adversaries may abuse such tools to establish persistence, gain unauthorized remote access, or facilitate further malicious activities within an environment.
Detects known malicious indicators, including C2 domain connections, suspicious file hashes, and specific mutexes often associated with malware execution.
Detects the execution of specific suspicious filenames ('YEPlayer.exe', 'Pis2rayVPN.msi', 'YEMPlayer.msi') or command-line references to these files, combined with correlated network activity to specific suspicious domains associated with masqueraded 'microsoft.comi-site.website' URLs.
This rule detects attempts to exploit the Nacos CVE-2021-29441 authentication bypass vulnerability. The vulnerability allows an attacker to bypass authentication by leveraging default or forged JWT tokens, specifically targeting the /nacos/ path with an Authorization header containing a Bearer token starting with 'eyJ'.
This rule detects network connections to a suspicious domain associated with the 'Maccy' application, as well as file and process activity involving files named 'Maccy' that interact with the same suspicious domain. This is indicative of potential unauthorized application execution or malicious activity masquerading as the Maccy utility.
Detects authorization, token grants, or consent events for two specific Google Workspace application ClientIDs, which may be indicative of OAuth application consent abuse or malicious integration.
Detects potential token impersonation activities where 'DuplicateTokenEx' or 'ImpersonateLoggedOnUser' functions are used in conjunction with 'explorer.exe'. This pattern is often used by adversaries to perform unauthorized privilege escalation or lateral movement by impersonating the security context of a logged-on user.
Page 191 of 249