Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the execution of 'net.exe' from a 'powershell.exe' parent process to either reset the local administrator password or reactivate a built-in domain administrator account. This behavior is associated with the Akira ransomware group's pre-encryption stage to ensure access to compromised endpoints.
Detects established TLS traffic originating from the internal network to external destinations on TCP port 99. This port is commonly used in legacy or non-standard configurations and, when combined with TLS, may indicate C2 relay infrastructure or unauthorized exfiltration channels.
This rule detects internal network traffic communicating with the Telegram Bot API endpoint 'api.telegram.org' using the 'getUpdates' method. This pattern is commonly used by malware for C2 polling to retrieve commands from an adversary-controlled Telegram bot.
This rule detects potential data exfiltration by monitoring for the creation of zip archives followed by an network connection to Telegram's API by the same device within a 10-minute window. This behavior often indicates that a user or an attacker is staging data in an archive and subsequently uploading it to a cloud file-sharing service.
Detects outbound network connections from common package managers (pip, npm) or utility tools (node, wget, curl) to destinations that are not related to official package repositories or local network ranges. This behavior may indicate an adversary using legitimate tools to download malicious payloads or establish command and control channels.
Detects the use of the native Windows 'reg.exe' utility to export sensitive registry hives (SAM, SECURITY, SYSTEM) commonly targeted by adversaries for offline credential extraction.
Detects unusual DNS requests initiated by common development, scripting, and administrative tools (e.g., node, python, powershell, curl) to domains that follow patterns often used for webhooks, relays, or command-and-control services. The rule specifically excludes common package management or source code repositories to reduce noise.
This rule detects DNS queries for domain names that exhibit patterns indicative of 'phantom squatting' targeting postal and courier services. These patterns often involve concatenating brand-related keywords (e.g., 'post', 'parcel', 'delivery') with service-oriented suffixes (e.g., '-login', '-verify', '-app') to create lookalike domains intended for phishing, credential harvesting, or infrastructure staging.
Detects Cavern Agent trojanized uxtheme.dll that hides real payload logic behind the EnableThemeDialogTexture export (ordinal #20) among 82 inert stub exports
Detects instances where the specific DLL 'n-ten.dll' is loaded by a process on a device that has experienced five or more failed network logon attempts within a one-hour window. This behavior potentially indicates an adversary attempting to gain access to a host via credential brute force followed by the execution of a custom or malicious library.
Page 207 of 249