Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
This rule detects unauthorized processes attempting to open a handle to the Local Security Authority Subsystem Service (lsass.exe) with PROCESS_VM_READ access rights. Such access is often associated with credential dumping techniques, particularly those utilizing direct syscalls to evade EDR and kernel-level monitoring by bypassing standard Windows API-based detection mechanisms.
Detects the execution of reverse engineering tools like Ghidra, Binary Ninja, or IDA Pro when their command-line arguments reference paths or names associated with EDR sensor drivers, binaries, or services. This behavior is indicative of an adversary conducting analysis of security software to identify potential blind spots or tampering opportunities.
Detects a Windows system BugCheck (Blue Screen of Death) event that occurs within two minutes of a process termination event. This behavior can be indicative of a process intentionally causing a system crash, often utilized by malware that abuses critical-process protection or attempts to evade analysis by forcing a system halt.
This rule detects processes that rapidly create and unload .NET application domains within a 60-second window. This behavior is often associated with .NET-based in-memory code execution, where attackers use AppDomains to isolate, execute, and quickly dispose of malicious payloads to avoid detection.
Detects outbound HTTP POST requests to a /gallery URI endpoint, which is associated with Cavern Manticore C2 beacons. The detection logic inspects the HTTP request body for a specific Base64-encoded pattern following XOR 0x48 encoding, indicating potential command-and-control communication.
Detects the PamStealer second-stage Rust-based arm64 Mach-O infostealer masquerading as Finder, identified by known SHA256 hash and embedded Rust toolchain build artifacts
Detects the second-stage Rust-based Mach-O binary downloaded and executed by the PamStealer JXA stager, identified via embedded C2 domain strings
This rule detects the creation of specific hidden files ('.Maccy', '.lock', '.config') within the 'Library/Application Support/com.apple.finder.core/' directory on macOS. This behavior is indicative of potential persistence mechanisms, configuration tampering, or malicious activity related to the Finder application environment.
Detects instances where a process located outside of the standard '/System/' or '/usr/' directories loads the 'Security.framework' library. This behavior is suspicious as it may indicate an attempt by an untrusted or malicious binary to hook into or interact with system-level security services, such as keychain or cryptographic APIs.
Detects unauthorized processes attempting to access sensitive browser data files (Login Data, Cookies, Web Data) that are typically used by web browsers to store credentials and session information. The rule filters out known legitimate browser processes, flagging potential credential theft or session hijacking activity.
Page 205 of 249