Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
This rule detects when specific legitimate-looking executables (BDSubWiz.exe, VSTestVideoRecorder.exe, GoogleDesktop.exe) initiate a module load from high-risk, world-writable directories such as '\Users\Public\', '\AppData\Local\Temp\', or '\Windows\Temp\'. This pattern is highly characteristic of DLL side-loading or masquerading, where an adversary uses a known benign process to load malicious code.
Detects the restart of an Azure Container Instance via the Microsoft.ContainerInstance/containerGroups/restart/action operation. This could indicate an attempt to disrupt service availability or potentially hide malicious modifications made to a container by forcing a state change.
This rule detects potential bulk domain registration activity by grouping registrations by registrar, name server, and a 18-minute window. It specifically flags cases where multiple domains are registered with privacy protection enabled, which is a common tactic for adversaries setting up large-scale C2 or phishing infrastructure.
This rule monitors DNS query traffic to detect potential C2 beaconing or exfiltration attempts by identifying source IP addresses that query a high volume of unique domains within a short, one-hour time window. It triggers when a host performs at least 10 unique domain queries within 60 minutes.
Detects inbound emails from external domains that contain both the recipient's job title and their company name in the subject or body, which is a common indicator of targeted spearphishing attacks (BEC/Whaling).
Detects instances where the same file (identified by SHA256) with common lure names like 'resume', 'headshot', or 'faceswap' is being created or modified by multiple different users across the environment. This behavior is often indicative of an adversary distributing malicious files or a coordinated effort to access sensitive or tempting filenames, potentially related to social engineering or lateral movement.
Detects the use of living-off-the-land binaries (mshta.exe, regsvr32.exe, certutil.exe, or wmic.exe) when executing with network-related or decoding command-line arguments. The rule specifically flags these invocations when they originate from parent processes not typically associated with legitimate system administration or software deployment workflows, targeting potential command-chain abuse or payload staging.
Detects indicators associated with CVE-2025-2492 or AiCloud activity in security logs.
Detects OS fingerprinting commands executed as child processes of a process that is actively listening on a network port, consistent with DOGLEASH.
This rule detects suspicious activity where a process initiates a network listening connection, launches a shell (sh, bash), and engages in file read or rename operations within a short 15-minute window. This behavior is indicative of a potential backdoor setup, lateral movement, or malicious script execution.
Page 196 of 249