Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects mass LDAP enumeration queries consistent with a modified BloodHound collector scraping AD users, computers, groups, and GPO/ACL data — customized by CISA's red team to evade static EDR signatures.
Detects process execution shortly after a user clicks a malicious link delivered via spearphishing email, indicating successful initial-access payload execution.
Detects a DCSync (directory replication) request targeting the krbtgt account, which yields the key material needed to forge Golden Tickets and impersonate any domain user. CISA's red team DCSynced krbtgt early in its Active Directory compromise (AA26-237A).
Detects DNS queries for a publicly enumerated subset of domains linked to
AnonyMousKIT by the cited research. The source condenses larger domain lists, so
this rule does not represent complete campaign-infrastructure coverage. A DNS
query records an observable lookup and does not prove that a network connection,
page load, or credential submission followed.
AnonyMousKIT by the cited research. The source condenses larger domain lists, so
this rule does not represent complete campaign-infrastructure coverage. A DNS
query records an observable lookup and does not prove that a network connection,
page load, or credential submission followed.
Detects bulk file enumeration/access across multiple users' virtual desktop profile shares via a compromised root DFS drive, which CISA's red team used to read local files of all users regardless of active session.
Detects service-principal/workload-identity sign-ins occurring without an enforced Conditional Access policy — a gap CISA's red team exploited for unauthorized cloud access.
Detects computer-account creation (Event ID 4741) by a non-administrative user, indicative of abuse of the default Machine Account Quota to join unauthorized machine accounts for privilege escalation, as exploited by CISA's red team.
Surfaces entities generating an unusually high volume of low-fidelity alerts that can mask a true-positive escalation event — the alert-fatigue and untuned-tooling gap CISA identified as a root cause of Organization A's failed detection.
Detects an executable loading an unexpected DLL, indicative of DLL side-loading used to execute a payload while evading static EDR signatures, as observed in CISA's red team engagement.
Detects instances of PowerShell being launched directly by explorer.exe with command-line arguments indicative of malicious activity, specifically the 'ClickFix' pattern where users are social-engineered to copy/paste malicious commands into the Windows Run dialog.
Page 2 of 249