Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects execution of Node.js applications that utilize specific Jscrambler obfuscation versions or the presence of these versions in package.json files, which may indicate the use of compromised or unauthorized supply chain dependencies.
Detects the use of BITSAdmin to create or manage BITS jobs using specific command-line flags that include suspicious external file paths or URLs, which are commonly associated with malicious downloader activity.
Detects instances where 'db.dll' is loaded by a process, followed closely by outbound network activity from processes typically associated with disk analysis tools like WinDirStat or suspected DLL hijacking patterns using uxtheme.dll. This behavior often suggests the presence of a malicious payload or credential harvesting module being used to interact with remote databases.
Detects network activity (DNS queries, HTTP requests, and TLS SNI) associated with the PamStealer malware communicating with its known command and control domain maccyapp.com.
Matches known Umbrij ConfuserEx-obfuscated .NET malicious DLL samples across three tool versions by full-file MD5 hash
This rule detects new or anomalous Google Workspace OAuth authorization events by monitoring for actions related to OAuth, consent, tokens, or authorization from IP addresses, geographical locations, or devices that have not been observed for the specific user account within the past 30 days.
This rule monitors for the creation of files containing the string 'readme_ransom' or the execution of processes that reference 'readme_ransom', specific known ransomware wallet addresses, or associated contact email addresses, which are indicative of post-encryption ransomware activity.
Detects processes attempting to masquerade as legitimate Cortex XDR components by including vendor-specific internal paths (e.g., cyserver, tdevflt) in their command-line arguments. Attackers may use this technique to trick endpoint security products into bypassing telemetry collection or applying incorrect exclusion policies based on matching path patterns.
Detects the LEASHTEST MIPS-compiled test binary linked to UAT-7810 ORB network R&D activity; presence indicates device compromise
Detects established TLS connections to external networks where the server certificate subject contains a Common Name (CN) but lacks Organization (O) or Organizational Unit (OU) fields. This pattern is characteristic of basic, potentially malicious self-signed certificates used by command-and-control (C2) frameworks to mask communication.
Page 197 of 249