Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects Android APK files that contain a combination of suspicious permissions and features often used for credential harvesting, specifically the binding of an accessibility service, SMS interception permissions, and overlay capability (System Alert Window).
Detects suspicious processes, such as those masquerading as legitimate system files or identified malware, accessing the webcam capability through the Windows CapabilityAccessManager consent store. This activity is often associated with remote surveillance commands initiated by RATs.
This rule detects potential ransomware or remote access trojan (RAT) activity by identifying either specific command-line indicators (/encrypt, /decrypt) or a high volume of file modifications (create, modify, or rename) across multiple directories within a short time frame, which is characteristic of mass file encryption operations.
Detects the execution of PowerShell with hidden window styles originating from a shortcut (.lnk) file. This behavior is commonly associated with malicious LNK files masquerading as PDF documents, often used as an initial access vector to launch stage-one payloads from temporary directories.
Detects the modification of Windows Defender exclusion settings using the Add-MpPreference or Set-MpPreference PowerShell cmdlets. Adversaries often abuse these cmdlets to add malicious files or directories to the exclusion list, allowing them to evade antivirus detection.
Detects the creation or modification of a file named 'maisum.dat' on endpoint devices. This filename is often associated with malicious activity, including malware persistence or configuration staging, and warrants investigation to determine the nature of the file and the process that created it.
This rule detects potential phishing activity by monitoring for the creation of specific PDF files matching common financial-themed lures and network connections to a known malicious domain 'facture-in.pages.dev'. It tracks file-based lure indicators on local devices and network requests to identify potential initial access or delivery stages of an attack.
Detects the creation, modification, or renaming of a specific property list file ('com.apple.system.services.activity') within the macOS LaunchAgents directory, a common technique used by attackers to maintain persistence on compromised systems.
Detects the 'codesign' utility being invoked with flags '-fs' (force sign) and '--deep' (recursively sign) triggered by a shell process spawned from 'Script Editor'. This pattern is often used to bypass macOS Gatekeeper or attempt to re-sign malicious applications after tampering.
Detects the execution of AppleScript files named 'Maccy.scpt' using the 'osascript' or 'Script Editor' utilities. The rule correlates this process execution with network activity directed towards the 'maccyapp.com' domain within a one-hour window, identifying potential unauthorized or malicious scripting behavior involving Maccy-related artifacts.
Page 208 of 249