Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects network traffic (DNS, TLS/HTTPS) communicating with the secondary hosting domain 'fileget.loseyourip.com' specifically attempting to retrieve potential payloads mimicking legitimate software (e.g., OBS Studio installer).
Detects outbound network connections (DNS queries or direct IP connections) to a set of known domains frequently associated with software cracking tools, unauthorized installers, or potentially unwanted programs (PUPs).
Detects instances where wscript.exe or cscript.exe executing a VBScript file subsequently spawns taskkill.exe with arguments intended to terminate PowerShell processes. This is a common pattern used by malicious scripts to disrupt security monitoring or automated management tasks.
Detects the execution of ScreenConnect (ConnectWise) remote support client processes with command line arguments indicative of a remote session initiation (e.g., Guest access connection). This pattern is often used by adversaries to establish persistence or remote control of compromised systems.
Detects modifications to Windows Registry keys responsible for UAC behavior (ConsentPromptBehaviorAdmin and EnableLUA) performed by common command-line utilities. Such modifications can be indicative of attempts to disable or weaken User Account Control (UAC) to facilitate privilege escalation or defense evasion.
Detects the use of PowerShell commands that reflectively load .NET assemblies into memory using 'Reflection.Assembly::Load' or 'Assembly.Load'. This technique is frequently utilized by malicious scripts and fileless malware to execute code directly in memory, bypassing traditional disk-based detection mechanisms.
Detects file creation or modification events occurring within directories containing the string 'SysMain_5874288', which may indicate malicious staging of files, persistence, or tool deployment often associated with potentially obfuscated or specific adversary naming patterns.
This rule detects network connections, specifically DNS queries or URL hits, to the domain 'facture-in.pages.dev'. It also looks for specific, indicative language within the RemoteUrl often associated with credential harvesting or phishing landing pages (e.g., 'no_mouse', 'wrong_timezone', 'A verificar o acesso').
Detects the creation or modification of a specific registry Run key entry named 'Financeiro' in the Windows 'CurrentVersion\Run' hive. Such registry keys are a common technique used by malware or unauthorized scripts to establish persistence, ensuring code execution upon user logon.
This rule detects the creation of files with naming conventions associated with common document-based phishing lures (e.g., invoices, fiscal documents) or DNS requests to specific domains (e.g., pages.dev) frequently leveraged by attackers for hosting malicious content.
Page 216 of 249