Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects in-memory DLL injection where a module is loaded into process memory without a backing file path on disk (action_module_path is null or empty). This technique, often referred to as reflective DLL injection, is used to evade detection. The rule further refines detection by flagging cases where the hosting process itself originates from an unusual or user-writable path, which can be indicative of DLL sideloading. This behavior is consistent with malware like Backdoor.Mistic or ModeloRAT, deployed by threat groups such as Woodgnat (KongTuke).
Detects social engineering lures (like ClickFix, FileFix, and CrashFix) where a user is tricked into manually executing a malicious payload. This rule specifically looks for script interpreters (powershell.exe, cmd.exe, mshta.exe, wscript.exe, cscript.exe) or Living Off The Land Binaries (LOLBins) (rundll32.exe, msiexec.exe, regsvr32.exe, curl.exe, certutil.exe, bitsadmin.exe) being spawned as child processes of web browsers (chrome.exe, msedge.exe, firefox.exe, iexplore.exe, brave.exe, opera.exe) or explorer.exe (indicating execution from a Run dialog). Exclusions are in place for common benign browser update processes.
Detects the creation of 'delete.me' files in sensitive Windows and SYSVOL directories. This behavior is a known artifact of the SoftPerfect Network Scanner, used during network enumeration to test for share writability.
Detects execution of common reconnaissance commands spawned by the AdgNsy.exe process, identified as an AdaptixC2 beacon. This behavior indicates post-exploitation discovery activity.
Detects remote LSASS memory dumping using the built-in comsvcs.dll MiniDump functionality, invoked by rundll32.exe. This activity is consistent with tools like lsassy, which leverage techniques such as SMB service creation, WMI, scheduled tasks, and DCOM/MMC to execute the dump remotely. The rule monitors for command lines containing comsvcs.dll and MiniDump, targeting the LSASS process or staging files in the Windows Temp directory.
Detects the creation of domain accounts named 'backup_DA' or 'backup_EA' and the subsequent addition of the 'backup_EA' account to the 'Enterprise Admins' group. This behavior is associated with the persistence and privilege escalation tactics used by the Akira ransomware group.
Detects high-frequency file creation, modification, or renaming activity within the user's Desktop directory. This pattern is often associated with ransomware activity, automated data exfiltration tools staging files, or malicious droppers unpacking payloads.
Detects the execution of processes containing the string 'detect_sandbox' in their command-line arguments. This pattern is commonly used by malicious code or automated tools attempting to determine if they are running within a virtualized or sandbox analysis environment.
This rule detects potential unauthorized access to web browser data files (such as Login Data, Cookies, or History) by processes other than the legitimate browser applications. It also identifies process command-line arguments often used by malicious tools to access browser data or bypass protections, which is a common indicator of credential theft from browsers.
Detects the creation or modification of a registry run key named 'MsEdgeUpdate' that points to an executable named 'svchost.exe' located within an 'AppData' directory. This behavior is highly suspicious as it mimics a legitimate Microsoft Edge update process to achieve persistence while running an arbitrary executable from a user-writable path.
Page 215 of 249