Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the LokiBot malware spawning aspnet_compiler.exe to perform process hollowing. The rule identifies this activity by monitoring process creation events and filtering out legitimate .NET build processes, targeting the specific behavior of using aspnet_compiler.exe as a host for reflective code injection.
Detects unauthorized processes attempting to access browser cookie storage files, which are commonly targeted by infostealer malware to extract session cookies for services like Jira and Atlassian SSO. Extracting these tokens allows attackers to bypass multi-factor authentication (MFA) and gain unauthorized access to accounts.
Detects successful authentication to Atlassian Jira from an anomalous network source (e.g., proxied or unusual geolocation/ASN) following a period of credential inactivity. This activity is consistent with tactics used by the HellCat ransomware group, who leverage credentials harvested by infostealers (such as Raccoon, Redline, StealC, or Lumma) to gain initial unauthorized access to corporate Jira environments.
This rule detects PowerShell commands that perform XOR decryption of an embedded payload using the hardcoded key 'Pussecretvk456' and subsequently use [System.Reflection.Assembly]::Load to reflectively load the resulting .NET assembly into memory. This behavior is indicative of fileless execution patterns commonly observed in the LokiBot and Amadey malware families.
Detects the LokiBot malware querying the 'MachineGuid' registry value located under 'HKLM\SOFTWARE\Microsoft\Cryptography'. This value is used by the malware to calculate an MD5 hash, which serves as a mutex name to ensure that only a single instance of the malicious process runs on the infected host.
Detects the LokiBot information stealer by identifying its characteristic aPLib compressed payloads, specific C2 URI patterns, known C2 infrastructure, and credential theft routines targeting applications like 1Password, Keepass, and WinBox.
Detects HTTP POST requests directed at PHP script endpoints with randomized 16-32 character hexadecimal filenames, which is a known C2 communication pattern used by the StealC infostealer.
Detects a specific command-line pattern used by the Amadey loader to perform self-relocation. The process chain executed via cmd.exe includes 'taskkill', 'timeout', 'del', and 'ren' in a single command line to terminate, delete, rename, and relaunch its executable from a user-writable directory to maintain persistence and evade detection.
Detects instances where explorer.exe spawns command-line utilities (cmd.exe, powershell.exe, mshta.exe) with command-line arguments indicative of file downloading or remote execution (e.g., curl, certutil, bitsadmin, Invoke-WebRequest). This pattern is often associated with ClickFix social engineering attacks, where a victim is tricked into pasting malicious commands directly into the Windows Run dialog.
Detects instances where Windows Script Host (wscript.exe or cscript.exe) spawns PowerShell or CMD. This pattern is commonly observed in malicious document loaders or script-based droppers, such as those associated with the LokiBot malware, which use JScript files to initiate secondary payload execution.
Page 219 of 249