Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the use of 'codesign' by 'Script Editor' on macOS to sign files within the '/Library/Application Support/' directory. This behavior is indicative of potential malicious activity, such as attempting to bypass Gatekeeper or signing tampered application files to maintain persistence or evade security controls.
Detects execution of processes named 'Finder' or 'Software Update' that originate from within the '/Library/Application Support/' directory on macOS. This pattern is indicative of potential masquerading where malicious binaries or persistent payloads are placed in shared application support folders to mimic legitimate system components.
Detects outbound network traffic from internal hosts to the domain 'avenger-sync.live' over TLS port 443, which is associated with PamStealer stage-two command and control communication.
Detects the macOS 'Finder' process loading 'ServiceManagement.framework' from a non-standard path within '/Library/Application Support/'. This behavior is highly suspicious as Finder should typically load system frameworks from standard paths, and unexpected module loading in this context may indicate code injection, tampering, or malicious activity disguised as part of the operating system.
Detects the short-lived execution of an AppleScript file named 'Maccy.scpt' using the Script Editor application. This pattern of execution, characterized by very brief process lifetimes, is often associated with automated tasks or potential abuse of AppleScript for command execution.
This rule detects command-line execution or activity containing specific strings associated with a fake 'damaged application' dialog box on macOS. This behavior is indicative of the PamStealer malware or similar social engineering campaigns that attempt to deceive users into believing their application is corrupt, thereby tricking them into interacting with malicious artifacts.
Detects DNS queries for domains matching a specific typosquatting pattern ('[a-z]{3,20}business.com') associated with the Montana Empire campaign, likely used for corporate banking credential harvesting.
Detects network requests originating from common package manager User-Agents (e.g., pip, npm, cargo) targeted at external domains that do not match known legitimate repositories. This behavior is indicative of potential command and control (C2) activity or malicious package staging using lookalike or arbitrary domains to bypass standard package registry traffic patterns.
Detects DNS queries for domains that mimic software package naming conventions (e.g., [name]-utils, [name]-api, [name]-client) that do not resolve to known legitimate registry domains. This behavior is indicative of potential dependency confusion attacks or malicious package installation attempts, where an attacker registers a domain designed to lure developers into downloading malicious code.
Detects modifications to the Windows microphone consent registry key (CapabilityAccessManager\ConsentStore\microphone) by processes running outside of standard Windows system directories (System32 or SysWOW64). This behavior is characteristic of unauthorized software attempting to grant itself persistence or surreptitiously gain access to audio hardware.
Page 209 of 249