Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
This rule detects modifications to Windows Registry Run keys, specifically looking for a registry value named 'Financeiro', which is a common persistence mechanism used to execute malicious programs automatically upon user logon.
Detects the creation or modification of a file named 'maisum.dat', which has been associated with malicious activity and malware behavior.
This rule detects the use of the 'SecTrustSetAnchorCertificatesOnly' macOS Security framework API call. This API is used to restrict trust to only the anchor certificates provided, which is a technique often used by malware or malicious scripts to bypass security trust controls, intercept TLS/SSL traffic, or facilitate adversary-in-the-middle attacks.
Detects frequent, persistent outbound TLS connections to api.telegram.org. This behavior is indicative of a malware sample or backdoor polling the Telegram Bot API for command and control (C2) instructions, effectively using the legitimate Telegram infrastructure to tunnel malicious communication.
Detects the execution of PowerShell or PWSH where the command line contains common environment variables and paths associated with the Windows Startup folder. This pattern is commonly used by adversaries to achieve persistence, ensuring malicious scripts execute upon user login.
Detects the execution of AppleScript files by the Script Editor application or the osascript utility, often associated with Maccy.scpt, which may indicate unauthorized script execution or automation attempts.
Detects access to sensitive cache or HTTP storage directories associated with the macOS 'Script Editor' application. Attackers may interact with these paths to persist scripts, modify application behavior, or stage data for exfiltration/execution.
Detects file creation or write operations within protected macOS System 'Application Support' directories that mimic legitimate Finder or system component filenames. This behavior is indicative of an attacker attempting to masquerade malicious files or persistence mechanisms as core macOS system utilities.
Detects repeated execution of the 'pbpaste' command initiated by the 'Finder' application where the parent process path originates from within the '/Library/Application Support/' directory. This behavior is indicative of a potentially malicious macOS plug-in or background component attempting to periodically monitor and extract clipboard data.
Detects a process masquerading as 'Finder' (i.e., having a different file path than the legitimate macOS Finder) that attempts to open System Settings, System Preferences, or the 'open' command to interact with Apple System Preferences related to Full Disk Access or Security settings. This behavior is indicative of an adversary attempting to modify privacy permissions or bypass system security controls.
Page 213 of 249