Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects instances where a process attempts to change memory permissions (using VirtualProtect) on sensitive security-related modules 'amsi.dll' or 'ntdll.dll'. This is a common technique used by shellcode loaders and malware to disable Antimalware Scan Interface (AMSI) or Event Tracing for Windows (ETW) by patching their respective scan functions in memory.
Detects unauthorized access to sensitive credential files, such as credentials.json or .env, through HTTP GET requests, or the creation/staging of a credentials file at /tmp/creds.json, which may indicate attempts to exfiltrate or steal credentials from the local system.
Detects the execution of macOS command interpreters (osascript, sh, bash, zsh) where the command line arguments reference specific timezones (e.g., Moscow, Minsk) or locale settings (e.g., RU, BY, KZ, AM, AZ). This pattern is often associated with adversary attempts to detect or evade sandbox environments based on regional settings or to align with specific target geographic profiles.
Detects the creation of a .plist file in a user LaunchAgents directory within 300 seconds of the process loading the ServiceManagement framework. This pattern is often used by macOS applications to establish persistence or perform background tasks, but can be indicative of malicious activity if associated with unauthorized or masquerading binaries.
Detects excessive network activity patterns by ff-agent which may indicate beaconing or unauthorized scanning activity. Note that this rule requires a backend capable of correlation or statistical aggregation.
This rule detects outbound TLS 1.2 traffic communicating over TCP port 99, which is a non-standard port for TLS/HTTPS traffic. This behavior is indicative of potential command-and-control (C2) communication where an adversary is attempting to hide traffic using encryption on an unconventional port.
This rule detects unauthorized or suspicious access attempts to a MinIO storage service by monitoring network traffic for default credentials, specific API calls like 'ListBuckets', or access to sensitive paths like 'terraform-state'. It triggers when traffic either targets the 'minio.internal' hostname or the local loopback address on port 9000, specifically looking for common MinIO administrative indicators.
Detects execution of processes using 'LOAD_FILE' (often associated with MySQL or specific command-line utilities) to attempt to read sensitive container-related paths such as '/var/run/docker.sock' or '/proc/1/cgroup'. This behavior is indicative of an attacker attempting to gather information for container escape or environment reconnaissance.
This rule detects potentially unauthorized access or activity related to MySQL databases. It monitors for external network connections to the MySQL default port (3306) that originate from non-private IP addresses, and identifies suspicious process command lines using Python's PyMySQL library that attempt to authenticate as the 'root' user.
This rule detects the creation of specific mutexes known to be associated with malicious software. Mutexes are often used by malware to ensure that only one instance of the malicious process is running on the host at a time, or to signal presence to other components.
Page 194 of 249