Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects PowerShell execution involving reflection patterns (GetMethod('C') and Invoke) combined with the execution or targeting of known Living-off-the-Land binaries (LOLBins). This pattern is often used to execute malicious payloads in-memory, bypassing traditional signature-based detection.
Detects suspicious process executions containing specific obfuscated strings or unique identifiers ('phuditimmer', 'instuite25', 'instuite43', 'instuite67') often associated with malicious tools or downloader activity.
Detects the use of the 'security' command-line utility to interact with the 'login.keychain-db' file on macOS, which is a common technique used by adversaries to dump credentials.
Detects the creation or modification of a file named '.config' within the path 'Library/Application Support/com.apple.finder.core/'. This behavior is indicative of potential persistence mechanisms, as adversaries often use hidden files within application support directories to maintain foothold or store configurations on macOS.
Detects the execution of processes containing command-line arguments '-debugport' or '-lport'. These flags are often used to configure remote debugging or listen ports, which can be abused by adversaries for persistence or command and control (C2) communication.
Detects the use of reg.exe to modify Windows Registry keys related to disabling or tampering with Windows Defender security settings, such as Real-time Monitoring, Tamper Protection, and various scanning features.
Detects the execution of 'ElevatorShellCode.exe' or the presence of 'ICMLuaUtil' in command-line arguments. 'ICMLuaUtil' is a known Windows COM interface frequently abused for UAC bypass and privilege escalation, while 'ElevatorShellCode' is indicative of suspicious tools attempting to gain higher integrity levels.
This rule detects processes accessing sensitive browser credential files ('passwords.json' or 'cookies.json') located in common browser profile output directories. Accessing these files is a common technique used by malware and adversaries to steal stored credentials from web browsers.
Detects HTTP GET requests to signindat.com for suspected malicious payloads, including executables (.exe) and scripts (.ps1), as well as a decoy PDF document. The rule identifies communication with an external host using generic User-Agent strings, characteristic of the CrySome RAT multi-stage download process.
Detects instances where common scripting or package management tools (e.g., node.exe, python.exe, pip.exe, npm.exe) launch Windows command line interpreters (powershell.exe, cmd.exe, wscript.exe, etc.) with command-line arguments indicative of potentially malicious activity, such as base64-encoded strings, command execution flags, or high-entropy command lines.
Page 203 of 249