Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects potential keylogging activity associated with Millenium RAT, characterized by the creation of log files with randomized 8-12 character filenames and folder names within the %APPDATA%\Roaming directory.
Detects the execution of the 'whoami' command via cmd.exe initiated with High integrity. This behavior is often associated with discovery efforts by adversaries operating with elevated privileges to identify the current user context.
This rule detects scenarios where common web browsers (Firefox, Chrome, Edge, IE) launch Windows scripting hosts (wscript.exe or cscript.exe) to execute .vbs files. This behavior is highly characteristic of drive-by download attacks or malicious browser-based content attempting to execute local scripts for further exploitation.
This rule detects DNS queries originating from the internal network towards the domain 'direct-download.giize.com', which has been associated with the unauthorized distribution of the ScreenConnect remote access tool. This activity is indicative of an attempt to download potentially malicious or unauthorized remote administration software.
Detects the creation of a Windows scheduled task via 'schtasks.exe' that specifically involves the 'MasterPackager.Updater' and execution of a 'script.vbs' file. This behavior is indicative of potential software deployment or persistence mechanisms utilizing VBScript within a scheduled task.
This rule identifies suspicious activity involving potential trojanized software installers and connections to known typosquatting or malicious domains. It flags processes spawned by common web browsers that match known malicious installer filenames and monitors for DNS queries to domains frequently associated with software supply chain or distribution-based malicious activity.
Detects instances where PowerShell.exe spawns Regasm.exe. Regasm.exe is a known Windows utility that can be abused to proxy execution of arbitrary code, a technique often used by adversaries to bypass application controls or execute malicious payloads.
Detects the use of msiexec.exe to execute installation commands specifically involving Visual C++ Redistributable DLLs (vcredist_x64.dll or vcredist_x86.dll) with quiet installation flags. This behavior may indicate an attempt to bundle or install dependencies via msiexec to proxy execution.
This rule detects repeated DNS queries to known Dynamic DNS (DDNS) providers within a 24-hour window, which may indicate an infected host beaconing to a command-and-control (C2) server utilizing dynamic infrastructure. Such rotation is commonly used by malware to maintain connectivity if primary infrastructure is blocked.
This rule monitors network traffic for specific command-and-control (C2) communication patterns associated with the Ousaban banking trojan. It detects response packets from an external server to a client machine containing JSON-like structural indicators such as 'inicio{', 'host', and 'porta' followed by '}fim'.
Page 212 of 249