Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the execution of known command-line artifacts and tools associated with direct and indirect system call resolution, such as SysWhispers, HellsGate, and HellHall. These techniques are commonly employed by adversaries to bypass user-mode EDR hooks by invoking NT syscalls directly.
Detects instances where a process is spawned with a spoofed parent process ID (PPID) that points to a known security software or EDR component. Attackers perform this technique to inherit the security exclusions applied to trusted security processes, thereby effectively bypassing EDR/AV monitoring.
Detects the execution of executable files from user-specific directories (Downloads, Desktop, Temp) that match common naming patterns associated with illicit software, such as cracks, keygens, or pirated tools. This is often an indicator of users attempting to run unauthorized software, which may carry secondary malware.
Detects file activity (creation, modification, copying, or renaming) within the 'leveldb' directories of popular web browsers (Chrome, Edge, Brave, Opera) and Discord applications by processes other than the legitimate application executables. This behavior is highly indicative of credential theft or data staging, often associated with malware attempting to extract browser session cookies, local storage databases, or stored credentials.
This rule detects rapid sequential DNS queries by a single host for multiple domains that mirror common brand impersonation patterns (e.g., login, business, empresas, post-app). The detection logic flags when at least two unique domains matching these patterns are queried within an 18-minute window, which is indicative of potential credential harvesting or phishing reconnaissance.
Detects instances where command-line arguments contain sensitive patterns such as cloud provider API keys, secret access keys, environment variable files, or cryptographic seed phrases. The rule specifically flags hosts where multiple such suspicious commands are executed, indicating potential reconnaissance or credential theft activity.
Detects a specific network handshake pattern indicative of the Cavern Manticore malware establishing a SOCKS5-over-WebSocket tunnel. The rule monitors for a WebSocket upgrade request followed by the initial SOCKS5 connection authentication byte sequence.
Detects the mass deletion of files within the directory 'C:\ProgramData\WinDir\'. This behavior is consistent with anti-forensic cleanup activities often performed by the Cavern Manticore malware framework to remove traces of its operational files and working directories after execution.
Detects rapid, suspicious command-line activity indicative of unauthorized user account creation or modification within a database environment, specifically targeting 'xadmin' or 'ROLE_ADMIN' roles accompanied by password hashing commands. The rule monitors for multiple events within a 120-second window to identify potentially automated or batch unauthorized account provisioning.
This rule monitors for processes dynamically resolving sensitive Windows networking API functions (WNetAddConnection2, NetShareEnum, NetUserEnum) at runtime using GetProcAddress. This technique is often used by malware to conceal its reliance on legitimate system APIs to perform discovery operations, such as enumerating network shares or users, while evading static analysis.
Page 202 of 249