Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects potential Millenium RAT activity where a process masquerading as a legitimate system file (e.g., svchost.exe or MsEdgeUpdate.exe) is executed from a non-standard directory and subsequently initiates network communication with the Telegram Bot API within a one-hour window. This behavior is indicative of malware beaconing and exfiltrating victim profiling data.
Detects potentially malicious activity involving MySQL processes, specifically focusing on the creation of files within the /var/lib/mysql-files/ directory, use of SQL 'INTO OUTFILE' for file output, or the use of 'LOAD_FILE()' to read sensitive system files like /etc/hostname or /proc/1/mountinfo, often indicative of SQL injection exploitation or unauthorized data access.
Detects the execution of command lines containing suspicious keywords associated with potential data encryption, database table destruction, or configuration tampering. These commands, such as those invoking encryption functions or dropping configuration tables, are indicative of malicious activity often performed by ransomware or wiper malware to hinder system recovery or exfiltrate and destroy data.
Detects an unusually large data transfer (greater than 5MB) from an internal MySQL server to an external network, which may indicate unauthorized database record exfiltration or data dumping.
Detects outbound network communication to an IP address (64.20.53.230) identified as a staging server associated with the JadePuffer activity. This activity involves potential data exfiltration following self-narrated deletion payloads.
Detects the invocation of script interpreters (python, bash, powershell, etc.) initiated by package management utilities (pip, npm, gem). This pattern is often indicative of supply chain attacks, automated malicious script delivery, or post-exploitation activity where legitimate development tools are abused to execute encoded or obfuscated commands.
Detects the autonomous execution of package manager commands (pip, npm, yarn) initiated by processes associated with AI agent pipelines, automation scripts, or CI/CD runners. This behavior is indicative of potential malicious activity where automated agents may be tricked into installing hallucinated or malicious packages from untrusted domains without human oversight.
Detects instances where common package management utilities (pip, npm, wget, curl) establish network connections to domains outside of verified official package registry endpoints. This pattern is often used in software supply chain attacks to retrieve malicious packages from attacker-controlled infrastructure.
Detects HTTP POST requests sent to Large Language Model (LLM) chat completion API endpoints where the URI query parameters contain keywords strongly associated with the creation of phishing kits, credential harvesting forms, or malware scaffolding. This rule aims to identify the use of AI tools to accelerate malicious development workflows.
Detects suspicious PowerShell activity using Active Directory enumeration cmdlets (e.g., Get-ADUser, Get-ADComputer, Get-DnsServerZone) that outputs results into CSV or text files within the C:\ProgramData directory. This pattern is commonly used during reconnaissance and staging for data exfiltration by threat actors.
Page 206 of 249