Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
This rule detects anomalous, high-frequency HTTP POST requests directed at sensitive API endpoints related to payment, billing, or administration. By calculating requests per minute and identifying unique source IP behavior, it aims to flag potential automated brute-force attacks, unauthorized API discovery, or data exfiltration attempts against critical system management interfaces.
Detects CI/CD package manager traffic (e.g., pip, npm) attempting to connect to domains that mimic legitimate PyPI or npm registry domains. This behavior is indicative of a dependency confusion or supply chain attack where an adversary uses typosquatted or phantom-squatted domains to intercept or redirect package requests.
Detects HTTP requests where the referrer is a major LLM service (e.g., ChatGPT, Claude) but the destination host uses keywords indicative of phantom squatting (e.g., parcel, delivery, login) suggesting an attempt to use LLM-generated content or platforms to facilitate malicious redirects or phishing.
Detects HTTP POST requests to known phishing kit endpoints 'panel_track.php' or 'verify_api.php', which are associated with the Montana Empire credential harvesting campaign.
Detects the use of package management tools (pip, npm, yarn) to install packages when initiated by common scripting interpreters or shells (python, cmd, powershell) in environments likely associated with CI/CD pipelines or automated workflows. The rule intentionally excludes jupyter and ipython interactive environments, suggesting it targets non-interactive or automated deployments.
This rule detects HTTP responses that return an Android Package (APK) file (application/vnd.android.package-archive) to a client. This is indicative of potential mobile malware delivery or unauthorized application distribution.
This rule detects DNS queries for domains that mimic legitimate package registry domains (such as PyPI, npm, etc.) using common typosquatting or lookalike patterns often exploited for dependency confusion or supply chain attacks. It identifies when systems reach out to domains attempting to impersonate trusted package management services.
Detects the execution of known system binary names (e.g., svchost.exe, MsEdgeUpdate.exe) from suspicious locations within the user AppData directory rather than the standard Windows System32 directory. This behavior is a common indicator of malware persistence, masquerading, or defensive evasion.
Detects access to 'wallet.dat' files (commonly associated with cryptocurrency wallets) by processes with misleading or suspicious names running from user AppData directories. This behavior is indicative of credential theft or malware attempting to exfiltrate digital assets.
Detects the execution of command-line shells (powershell.exe or cmd.exe) spawned by processes that are typically associated with system services or security products (e.g., svchost.exe, MsEdgeUpdate.exe), where the parent process is not located in the standard Windows System32 directory. This pattern often indicates attempts to bypass security controls or masquerading by malicious actors to achieve code execution.
Page 211 of 249